Blind Server-Side Request Forgery in SPIP Affected by Vulnerability

CVE-2026-27472

What is CVE-2026-27472?

SPIP prior to version 4.4.9 is susceptible to a blind server-side request forgery (SSRF) vulnerability due to improper validation of syndication URLs in the private area. This flaw enables authenticated attackers to send requests from the server to unauthorized internal or external destinations when managing syndicated sites. The existing security measures within SPIP do not effectively mitigate this issue, posing a significant risk to the integrity and confidentiality of server resources.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References