CVE-2026-27472

EUVD-2026-8318
SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
spipspip
4.4.0 ≤
𝑥
< 4.4.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
spip
bullseye
vulnerable
bullseye (security)
vulnerable
forky
4.4.13+dfsg-1
fixed
sid
4.4.13+dfsg-1
fixed
trixie
4.4.11+dfsg-0+deb13u1
fixed
trixie (security)
4.4.13+dfsg-0+deb13u1
fixed
Common Weakness Enumeration
References
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html
https://git.spip.net/spip/spip
https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites