CVE-2025-71241

Received Received - Intake

Cross-Site Scripting in SPIP Private Area via Unsanitized API

Publication date: 2026-02-19

Last updated on: 2026-03-02

Assigner: VulnCheck

Description

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-19

Last Modified

2026-03-02

Generated

2026-07-06

AI Q&A

2026-02-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-71241

EUVD

EUVD-2025-207684

Affected Vendors & Products

Vendor	Product	Version / Range
spip	spip	From 4.1.0 (inc) to 4.1.20 (exc)
spip	spip	From 4.2.0 (inc) to 4.2.17 (exc)
spip	spip	From 4.3.0 (inc) to 4.3.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects SPIP versions before 4.3.6, 4.2.17, and 4.1.20 and allows Cross-Site Scripting (XSS) attacks in the private area of the application.

The issue arises because the content of the error message displayed by the 'transmettre' API is not properly sanitized, which means an attacker can inject malicious scripts into the error message.

This vulnerability is mitigated by the SPIP security screen.

Impact Analysis

An attacker exploiting this vulnerability could inject malicious scripts into the private area of the SPIP application.

This could lead to unauthorized actions being performed on behalf of a legitimate user, theft of sensitive information, or other malicious activities within the private area.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability is mitigated by the SPIP security screen.

To mitigate this vulnerability, ensure that you are using SPIP version 4.3.6, 4.2.17, 4.1.20 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2025-71241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70