Insecure Deserialization in SPIP Affects Multiple Versions by SPIP Team

CVE-2025-71250

What is CVE-2025-71250?

SPIP versions prior to 4.4.9 are susceptible to an Insecure Deserialization vulnerability that arises from the use of the table_valeur filter and DATA iterator, which accept serialized data from user input. An attacker with access to inject malicious serialized content can trigger arbitrary object instantiation, bringing about potential code execution. This flaw poses significant risks as the use of serialized data in these areas has been deprecated and will see removal in SPIP version 5. Notably, this vulnerability is not effectively mitigated by SPIP’s existing security measures.

References