CVE-2026-109378

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18

Description Authenticated attackers can perform a server-side request forgery (SSRF) by providing a remote URL, such as a remote document or a syndicated site feed. The issue exists in the recuperer url() function within ecrire/inc/distant.php, which follows up to 10 redirects without re-validating the targets using the valider url distante() function. This allows requests to be redirected to internal or link-local addresses, including cloud metadata endpoints.

Recommendations Update to version 4.4.18 or later.