The vulnerability is a remote code execution flaw in the private space of SPIP versions prior to 4.4.14. By sending specially crafted input, an attacker can run arbitrary code on the web server, bypassing the SPIP security screen protections. This is a code injection weakness (CWE‑94) that allows an attacker to compromise confidentiality, integrity, and availability of the affected system.

The flaw affects the SPIP content management system and its private space feature. All SPIP installations with versions earlier than 4.4.14 are vulnerable. No specific patch versions are listed in the data, so any version below 4.4.14 should be considered at risk.

The CVSS score of 8.7 places the vulnerability in the High severity range, indicating that exploitation can result in full control over the affected server. EPSS data is not available, so the current exploitation probability is unknown, though the lack of KEV listing suggests no publicly known exploit yet. Attackers can likely reach the vulnerable code remotely via the private space interface, assuming the site is accessible and the attack requires no user interaction. The high severity and the potential for complete system takeover make this a critical risk for organizations running SPIP without a recent update.