CVE-2025-71243: SPIP Saisies Plugin < 5.11.1 Remote Code Execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-19 · updated 2026-06-17
Weakness: CWE-94

Description

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

Affected products

SPIP Saisies pour formulaire: from 5.4.0 before 5.11.1 — fixed in 5.11.1

How to fix

Upgrade to a fixed version: SPIP Saisies pour formulaire 5.11.1. Check the vendor advisory for mitigations.

References

https://blog.spip.net/Mise-a-jour-critique-de-securite-pour-le-plugin-Saisies.html
https://plugins.spip.net/saisies
https://www.vulncheck.com/advisories/spip-saisies-plugin-remote-code-execution

Get alerted when CVE-2025-71243 or the next vulnerability affects your stack