CVE-2026-109378 in SPIP
Summary
by MITRE • 10/13/2026
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in SPIP versions prior to 4.4.18 represents a critical server-side request forgery flaw located within the recuperer_url function found in the ecrire/inc/distant.php module. This component is responsible for fetching remote content, such as syndicated site feeds or external documents, which are common features in content management systems that aggregate information from various sources. The core technical deficiency lies in the redirect handling logic of this function. When processing a URL provided by an authenticated user, the system follows up to ten HTTP redirects without re-validating each intermediate target against the valider_url_distante security check. This validation mechanism is designed to ensure that requests remain within allowed domains or safe boundaries, but its absence during the redirection chain creates a significant bypass opportunity for attackers who have valid authentication credentials.
From an operational perspective, this flaw allows authenticated users to manipulate the destination of server-side HTTP requests initiated by the application itself. By supplying a remote URL that redirects through multiple hops to internal network addresses, link-local IPs, or cloud metadata endpoints, an attacker can force the SPIP server to communicate with resources it would otherwise be restricted from accessing. This is particularly dangerous in modern infrastructure where servers often have access to sensitive internal services such as database clusters, administrative panels, or cloud instance metadata stores like AWS EC2 Instance Metadata Service (IMDS) or Azure Managed Identity endpoints. These metadata services typically contain authentication tokens and configuration details that can lead to full system compromise if accessed by an unauthorized party.
The security implications of this vulnerability align closely with CWE-918, which describes Server-Side Request Forgery (SSRF). The specific behavior of following redirects without re-validation also relates to CWE-437, the improper interpretation of a function in a third-party component or library context, although here it is more accurately characterized as an incomplete validation during state transitions. In terms of offensive security frameworks, this attack vector maps directly to MITRE ATT&CK technique T1502.001, known as Exploitation for Cloud Infrastructure Discovery via SSRF. Attackers can leverage this flaw not only to discover internal network topology but also to exfiltrate sensitive data from cloud environments or pivot further into the backend infrastructure by accessing unprotected internal APIs and services that are exposed to the web server's network interface.
Mitigation strategies must focus on enforcing strict validation at every step of the request lifecycle rather than just at the initial entry point. Developers should modify the recuperer_url function to invoke valider_url_distante or an equivalent security check after each redirect is resolved, ensuring that no intermediate target violates the allowed domain policy. Additionally, implementing network-level controls such as egress filtering can provide a robust defense-in-depth layer by blocking outbound requests from web servers to private IP ranges and cloud metadata endpoints regardless of application logic flaws. Upgrading to SPIP version 4.4.18 or later is essential as it addresses this specific validation gap in the remote URL processing routine, thereby closing the attack path for authenticated adversaries seeking to exploit SSRF conditions within the platform.