CVE-2026-109378 — SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating target…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7