CVE-2016-7980: Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier al...

Security readout for executives and security teams

CVE-2016-7980 lets an attacker abuse a logged-in SPIP administrator’s browser to trigger the XML validator against a local file. By itself it is a CSRF issue requiring administrator interaction. Public notes warn it can be chained with CVE-2016-7998 to execute arbitrary PHP code. Exposure is most likely on SPIP 3.1.2 or earlier, especially where the ecrire administration interface is reachable and administrators browse while authenticated. Prioritize if the organization still runs legacy SPIP. The business risk is not broad unauthenticated takeover by itself, but administrator-targeted compromise can become severe when combined with the related code-execution issue. Mitigation focus: Identify all SPIP installations and confirm whether versions are 3.1.2 or earlier.; Review SPIP vendor guidance and apply the relevant fixed release or upstream revisions.; Restrict access to the SPIP ecrire administration interface to trusted networks..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.