CVE-2022-26846: 
NixOS vulnerability analysis and mitigation

SPIP before versions 3.2.14 and 4.x before 4.0.5 contained a critical security vulnerability that allowed remote authenticated editors to execute arbitrary code. The vulnerability was discovered and reported by security researcher g0uZ in March 2022 (SPIP Blog).

The vulnerability exploited legacy code related to a Gallery mode in the Media plugin that had been present since SPIP 3.0 for backward compatibility but was largely unused. This code allowed authenticated users with editor privileges to execute arbitrary PHP code on the system (SPIP Blog).

The vulnerability allowed authenticated attackers with editor privileges to execute arbitrary code on the affected system, potentially leading to complete system compromise (Ubuntu Notice).

The vulnerability required authentication with editor privileges to exploit. The affected code was present but largely unused since SPIP 3.0, making exploitation less likely but still critical for systems where the legacy gallery functionality was enabled (SPIP Blog).

The vulnerability was fixed in SPIP versions 3.2.14 and 4.0.5. Users are strongly advised to upgrade to these versions or later. For sites still using the legacy gallery functionality, administrators must explicitly declare authorized gallery files in the medias_deprecated_liste_galeries global variable. The vulnerable code has been deprecated and will be removed entirely in SPIP 5.0 (SPIP Blog).