# CVE-2016-7999: SPIP SSRF in valider_xml.php

Source: https://junglewise.ai/threats/cve-2016-7999-spip-ssrf-in-valider-xml-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7999 · Severity: high · CVSS 7.4 · Published 2017-01-18

SPIP, a popular open-source content management system, is vulnerable to a security flaw in its XML validation component. An attacker can trick the server into making unauthorized network requests to internal or external systems. This could allow an attacker to bypass firewalls, scan internal networks, or interact with sensitive services that are not normally accessible from the internet.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2016-7999 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7999 being exploited in the wild.

**How severe is CVE-2016-7999?** High severity, with a CVSS score of 7.4, published 18 January 2017.

**Which products and versions are affected?** SPIP SPIP <= 3.1.2.

**Is there a fix for CVE-2016-7999?** A patch was published on 2016-09-27: SPIP team corrected the vulnerability in repository revisions 23188 and 23193 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7999 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2016-7999?** Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in SPIP versions 3.1.2 and earlier within the `ecrire/exec/valider_xml.php` script. The vulnerability is caused by insufficient validation of the `var_url` parameter in the `valider_xml` action, which allows remote attackers to initiate HTTP or FTP requests from the server. Specifically, the `is_dir()` function and `recuperer_page()` are called on user-supplied URLs, enabling an attacker to probe internal network resources or bypass access controls. The fix involves rejecting URLs containing protocol delimiters like '://' to prevent outbound network traffic. This was patched in SPIP 3.1.3.

## Affected products

- SPIP SPIP <= 3.1.2

## Timeline

- 2016-09-15: disclosed: Initial discovery by Sysdream Labs
- 2016-09-27: patched: SPIP team corrected the vulnerability in repository revisions 23188 and 23193
- 2016-09-30: patched: SPIP 3.1.3 released
- 2017-01-18: advisory: NVD publication date

## References

- [http://www.openwall.com/lists/oss-security/2016/10/05/17](http://www.openwall.com/lists/oss-security/2016/10/05/17)
- [http://www.openwall.com/lists/oss-security/2016/10/07/5](http://www.openwall.com/lists/oss-security/2016/10/07/5)
- [http://www.openwall.com/lists/oss-security/2016/10/08/6](http://www.openwall.com/lists/oss-security/2016/10/08/6)
- [http://www.openwall.com/lists/oss-security/2016/10/12/10](http://www.openwall.com/lists/oss-security/2016/10/12/10)
- [http://www.securityfocus.com/bid/93451](http://www.securityfocus.com/bid/93451)
- [https://core.spip.net/projects/spip/repository/revisions/23188](https://core.spip.net/projects/spip/repository/revisions/23188)
- [https://core.spip.net/projects/spip/repository/revisions/23193](https://core.spip.net/projects/spip/repository/revisions/23193)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce)
- [SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)