CVE-2006-0625: Spip

Medium severity, CVSS 6.4. EPSS: 4.9% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via ".." sequences in the GLOBALS[type_urls] parameter, which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3.

Affected products

• Spip Spip: version 1.8.2d only; version 1.8.2e only; version 1.8.2g only

Published 2006-02-09. Last modified 2026-06-16.