CVE catalog

CVE-2025-71241

UBUNTU-CVE-2025-71241

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

SPIP before 4.3.6, 4.2.17, and 4.1.20 allows Cross-Site Scripting (XSS) in the private area. The content of the error message displayed by the 'transmettre' API is not properly sanitized, allowing an attacker to inject malicious scripts. This vulnerability is mitigated by the SPIP security screen.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspip134.3.6+dfsg-1fixed
Debianspip144.3.6+dfsg-1fixed
Ubuntuspippro3.2.4-1vulnerable
Ubuntuspippro3.2.5-1vulnerable
Ubuntuspippro3.2.7-1vulnerable
Ubuntuspippro3.2.7-1ubuntu0.1vulnerable
Ubuntuspippro3.2.7-1ubuntu0.1+esm2vulnerable
Ubuntuspip22.043.2.11-3vulnerable
Ubuntuspip22.043.2.12-1vulnerable
Ubuntuspip22.044.0.2-1vulnerable
Ubuntuspip22.044.0.4-1vulnerable
Ubuntuspip24.044.1.11+dfsg-1vulnerable
Ubuntuspip24.044.1.12+dfsg-1vulnerable
Ubuntuspip24.044.1.13+dfsg-1vulnerable
Ubuntuspip24.044.1.15+dfsg-1vulnerable
Ubuntuspip24.044.2.9+dfsg-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspipdeb134.3.6+dfsg-1Not reportedDEBIAN-CVE-2025-71241Not reported
Debianspipdeb144.3.6+dfsg-1Not reportedDEBIAN-CVE-2025-71241Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [spip]Fixed
    Details (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 4.3.6+dfsg-1

      pypi · spip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]