CVE-2026-27472SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites

Description

SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html vendor-advisorypatchRelease NotesVendor Advisory
• https://git.spip.net/spip/spip productProduct
• VulnCheck Advisory: SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites third-party-advisoryThird Party Advisory