CVE-2026-109378 SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
Authenticated attackers can exploit SSRF in SPIP to access internal resources or cloud metadata via malicious redirects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-109378?
CVE-2026-109378 is a medium-severity server-side request forgery vulnerability in SPIP, published on 12 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.
Weakness: CWE-918
Which versions are affected by CVE-2026-109378?
How do I fix CVE-2026-109378?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-109378 being exploited?
There is no known exploitation of CVE-2026-109378 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-109378, GHSA-8gmq-ghhj-j4rh, UBUNTU-CVE-2026-109378.