CVE-2026-109378: SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recupererurl() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with validerurldistante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.
Affected Software
Event History
Frequently Asked Questions
Which users and features create exposure?
An authenticated attacker must be able to provide a remote URL to functionality that uses recuperer_url(), such as a syndicated site feed or remote document. The issue affects SPIP versions before 4.4.18.
What can an attacker reach through the vulnerable request handling?
A supplied remote URL can redirect the server to internal or link-local addresses, including cloud metadata endpoints. The redirect target is not revalidated with valider_url_distante().
How many redirects can be used in an exploit chain?
The vulnerable behavior follows up to 10 redirects. An attacker can use a redirecting URL to move the server-side request from an initially supplied remote address to an internal target.
What version should be deployed to address this issue?
Upgrade to SPIP 4.4.18 or later. The vulnerability is described as affecting versions before 4.4.18.