CVE-2026-109378SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url

Descripción

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• SPIP 4.4.18 security release vendor-advisoryrelease-notes
• https://git.spip.net/spip/spip product
• VulnCheck Advisory: SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url third-party-advisory