CVE-2026-109378

Deferred Deferred - Pending Action

SPIP Server-Side Request Forgery in URL Handling

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109378

Affected Vendors & Products

Vendor	Product	Version / Range
SPIP	SPIP	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

SPIP before version 4.4.18 has a server-side request forgery (SSRF) vulnerability in the recuperer_url() function. This flaw allows authenticated attackers to supply a remote URL, such as a syndicated site feed or document, that can redirect up to 10 times without re-validating the target URL. Attackers can exploit this to access internal or link-local addresses, including cloud metadata endpoints.

Detection Guidance

To detect this vulnerability, monitor for outbound requests to internal or link-local addresses from SPIP instances. Check logs for URLs being fetched via recuperer_url() in ecrire/inc/distant.php. Look for excessive redirects (up to 10) without proper validation. Inspect network traffic for connections to cloud metadata endpoints or internal IPs.

Impact Analysis

This vulnerability could allow attackers to access internal systems or sensitive network resources by tricking the server into making unauthorized requests. This may lead to data leaks, unauthorized access to cloud metadata, or further network reconnaissance.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized access to internal or link-local addresses, including cloud metadata endpoints. Authenticated attackers exploiting this issue might exfiltrate sensitive data or interact with internal systems, which could violate data protection requirements under these regulations.

Mitigation Strategies

Upgrade SPIP to version 4.4.18 or later to address the server-side request forgery vulnerability in recuperer_url().

Hi! I’m here to help you understand CVE-2026-109378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70