Medium severity4.3NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026

CVE-2026-109378

Description

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Spip/Spipllm-fuzzy
Range: <4.4.18

Patches

Vulnerability mechanics

References

blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.htmlnvd
www.vulncheck.com/advisories/spip-before-4.4.18-ssrf-via-http-redirects-in-recuperer-urlnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000