CVE-2024-7954: 
Linux Debian vulnerability analysis and mitigation

The porte_plume plugin used by SPIP before versions 4.30-alpha2, 4.2.13, and 4.1.16 contains a critical arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP code as the SPIP user by sending a specially crafted HTTP request (NVD, VulnCheck). The vulnerability was discovered by Louka Jacques-Chevallier and assigned CVE-2024-7954 with a CVSS score of 9.8 CRITICAL.

The vulnerability exists in the porte_plume plugin's preview functionality that processes user input. The issue stems from improper handling of specially crafted URLs with complex formatting in the preview system. When a maliciously formatted URL is submitted through the previsualization feature, it can bypass the intended sanitization and result in arbitrary PHP code execution (SPIP Blog, ThinkLoveShare).

The vulnerability allows unauthenticated attackers to execute arbitrary PHP code with the privileges of the SPIP user. This could lead to complete system compromise, data theft, service disruption, and potential lateral movement within the affected network (VulnCheck).

Users should immediately upgrade to the patched versions: SPIP 4.30-alpha2, 4.2.13, or 4.1.16. The patches include security improvements that prevent unauthorized PHP code execution through the porte_plume plugin's preview functionality (SPIP Blog).