# CVE-2016-7998: SPIP remote PHP code execution in template compiler

Source: https://junglewise.ai/threats/cve-2016-7998-spip-remote-php-code-execution-in-template-compiler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7998 · Severity: high · CVSS 8.8 · Published 2017-01-18

SPIP, a popular open-source content management system, contains a vulnerability that allows logged-in users to execute malicious code on the server. By uploading a specially crafted file and triggering a specific validation action, an attacker can take full control of the website and its underlying data. This could lead to a complete site takeover, data theft, or the use of the server for further attacks.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2016-7998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7998 being exploited in the wild.

**How severe is CVE-2016-7998?** High severity, with a CVSS score of 8.8, published 18 January 2017.

**Which products and versions are affected?** SPIP SPIP <= 3.1.2.

**Is there a fix for CVE-2016-7998?** A patch was published on 2016-09-27: Fixes committed to SPIP repository (revisions 23186, 23189, 23192) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7998 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-7998?** Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution vulnerability exists in the SPIP template compiler/composer (specifically in `ecrire/public/compiler.php`) due to improper input validation of file names. Authenticated users can exploit this by uploading an HTML file containing a crafted `INCLUDE` or `INCLURE` tag that includes double quotes to break out of the PHP string context during template compilation. When the file is subsequently accessed via the `valider_xml` action, the injected PHP code is executed on the server. The fix involves properly escaping double quotes in file names within the `calculer_inclure` function to prevent code injection.

## Affected products

- SPIP SPIP <= 3.1.2

## Timeline

- 2016-09-27: patched: Fixes committed to SPIP repository (revisions 23186, 23189, 23192)
- 2016-10-05: disclosed: Vulnerability details shared on oss-security mailing list
- 2017-01-18: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/10/05/17](http://www.openwall.com/lists/oss-security/2016/10/05/17)
- [http://www.openwall.com/lists/oss-security/2016/10/07/5](http://www.openwall.com/lists/oss-security/2016/10/07/5)
- [http://www.openwall.com/lists/oss-security/2016/10/08/6](http://www.openwall.com/lists/oss-security/2016/10/08/6)
- [http://www.securityfocus.com/bid/93451](http://www.securityfocus.com/bid/93451)
- [https://core.spip.net/projects/spip/repository/revisions/23186](https://core.spip.net/projects/spip/repository/revisions/23186)
- [https://core.spip.net/projects/spip/repository/revisions/23189](https://core.spip.net/projects/spip/repository/revisions/23189)
- [https://core.spip.net/projects/spip/repository/revisions/23192](https://core.spip.net/projects/spip/repository/revisions/23192)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce)
- [SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)