SPIP Interface Traduction Objets Plugin Authenticated Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the SPIP interface_traduction_objets plugin, affecting versions prior to 4.3.3. This vulnerability arises in the translation interface workflow, where untrusted request data is incorporated into a hidden form field without proper output filtering. Fields that begin with an underscore bypass certain protection mechanisms, allowing an authenticated attacker with editor-level privileges to inject malicious content. This injected content is processed through SPIP's template engine, enabling code execution on the web server.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where SPIP is hosted.

Remediation

Users can update to SPIP interface_traduction_objets version 4.3.3 or later to address this vulnerability.