CVE-2026-27472 — SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites
SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that …
Published: 2026-02-19 · CVSS: 5.3 · CVSS 4.0
SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7