CVE-2026-109378: SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-13
Weakness: CWE-918

Description

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.

Affected products

SPIP: before 4.4.18 — fixed in 4.4.18

How to fix

Upgrade to a fixed version: SPIP 4.4.18. Check the vendor advisory for mitigations.

References

https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html
https://git.spip.net/spip/spip
https://www.vulncheck.com/advisories/spip-before-4.4.18-ssrf-via-http-redirects-in-recuperer-url

Get alerted when CVE-2026-109378 or the next vulnerability affects your stack