Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-109378: SPIP may let attackers reach internal servers
CVE-2026-109378 · published 23 days ago
Summary
The SPIP publishing system (versions before 4.4.18) can be made to request URLs that redirect to other addresses, including those inside your own network or cloud metadata services. If a user with login rights supplies a crafted link, the server could unintentionally connect to internal resources, potentially exposing sensitive data. Update SPIP to version 4.4.18 or later, or restrict the ability to add external URLs until the fix is applied.
What to do
- Update debian spip to version 4.4.19+dfsg-0+deb13u1.
- Update debian spip to version 4.4.18+dfsg-1.
- Update spip spip to version 4.4.18 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | spip | spip | < 4.4.18 |
| Debian:13 | debian | spip |
< 4.4.19+dfsg-0+deb13u1 Fix: upgrade to 4.4.19+dfsg-0+deb13u1
|
| Debian:14 | debian | spip |
< 4.4.18+dfsg-1 Fix: upgrade to 4.4.18+dfsg-1
|
| Ubuntu:Pro:16.04:LTS | canonical | spip | All versions |
Original advisory text
SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.
References
- https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.htm... Third Party Advisory
- https://git.spip.net/spip/spip Third Party Advisory
- https://www.vulncheck.com/advisories/spip-before-4.4.18-ssrf-via-http-redirects-... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-109378 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1093... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109378 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-109378 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-109378 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published12 Oct 2026
Updated4 Nov 2026
First seen12 Oct 2026
Sources
CVE-2026-109378 · NVD
CVE-2026-109378 · MITRE
DEBIAN-CVE-2026-109378 · OSV
CVE-2026-109378 · OSV
UBUNTU-CVE-2026-109378 · OSV
Track software like this
Free during beta