CVE-2026-109378

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-918

Impact

Authenticated attackers can scan internal services and access link-local metadata endpoints via server-side request forgery. They need an authenticated account capable of supplying external URLs, such as site feeds or remote documents.

Root cause

The recuperer_url() function follows HTTP redirects without re-validating the redirected destination using valider_url_distante().

Affected systems

SPIP before 4.4.18

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to SPIP 4.4.18 or later. If patching cannot happen immediately, restrict outbound network access from the web server to private subnets and metadata IP addresses (e.g., 169.254.169.254) at the host firewall level.

shell

$ composer update spip/spip

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109378