Blind Server-Side Request Forgery in SPIP Affects Multiple Versions

CVE-2025-71247

What is CVE-2025-71247?

The SPIP content management system, prior to version 4.4.9, is susceptible to a Blind Server-Side Request Forgery vulnerability. This weakness arises in the private area of the application, particularly while editing syndicated sites. The system fails to validate the syndication URL, allowing an authenticated attacker to direct the server to send requests to arbitrary internal or external destinations. Unfortunately, this issue is not addressed by the existing SPIP security measures, posing a significant risk for users and their data.

References