Server-Side Request Forgery in SPIP Affected by URL Redirects

CVE-2026-109378

What is CVE-2026-109378?

The SPIP content management system prior to version 4.4.18 is susceptible to a server-side request forgery (SSRF) vulnerability. This flaw exists in the recuperer_url() function, which allows authenticated attackers to submit a remote URL. The vulnerability arises as it follows up to 10 redirects without properly validating the targets through valider_url_distante(). As a result, attackers can redirect requests to internal or link-local addresses, including sensitive cloud metadata endpoints, potentially leading to unauthorized access to sensitive information within the server.

References