SPIP versions before 4.4.14 are vulnerable to remote code execution in the public area when deployed with specific nginx configurations. An attacker who can craft requests that reach the vulnerable path can run arbitrary code with the privileges of the web server process. This flaw is a code injection issue (CWE-94) where the application fails to sanitize input that ends up executed by the web server.

All SPIP installations older than 4.4.14 that are accessed through nginx and use the configurations known to trigger the flaw. The vulnerability is specific to nginx setups where certain directives allow user input to reach the web server’s execution context. No other products are mentioned as affected, and no detailed version list is provided beyond the version threshold.

With a CVSS score of 9.2, the vulnerability is considered highly severe. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalogue, suggesting that it may not yet be widely exploited, yet the potential impact is catastrophic. Attackers can exploit it via crafted HTTP requests when the nginx configuration permits the vulnerable code path, allowing full control over the web server process.