CVE-2019-16391: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.

Affected products

• Canonical Ubuntu Linux: version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Spip Spip: before 3.1.11 (fixed in 3.1.11); from 3.2.0, before 3.2.5 (fixed in 3.2.5)

Published 2019-09-17. Last modified 2026-06-17.