CVE-2025-71244

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71244
SPIP before 4.4.5 and 4.3.9 allows an Open Redirect via the login form when used in AJAX mode. An attacker can craft a malicious URL that, when visited by a victim, redirects them to an arbitrary external site after login. This vulnerability only affects sites where the login page has been overridden to function in AJAX mode. It is not mitigated by the SPIP security screen.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5.html Broken Link
https://git.spip.net/spip/spip Product
https://www.vulncheck.com/advisories/spip-open-redirect-via-login-form Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:03

Type Values Removed Values Added
Summary
  • (es) SPIP anterior a 4.4.5 y 4.3.9 permite una redirección abierta a través del formulario de inicio de sesión cuando se utiliza en modo AJAX. Un atacante puede crear una URL maliciosa que, cuando es visitada por una víctima, los redirige a un sitio externo arbitrario después de iniciar sesión. Esta vulnerabilidad solo afecta a los sitios donde la página de inicio de sesión ha sido sobrescrita para funcionar en modo AJAX. No es mitigada por la pantalla de seguridad de SPIP.

24 Feb 2026, 19:27

Type Values Removed Values Added
References () https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5.html - () https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-5.html - Broken Link
References () https://git.spip.net/spip/spip - () https://git.spip.net/spip/spip - Product
References () https://www.vulncheck.com/advisories/spip-open-redirect-via-login-form - () https://www.vulncheck.com/advisories/spip-open-redirect-via-login-form - Third Party Advisory
CPE cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
First Time Spip spip
Spip

19 Feb 2026, 16:27

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-19 16:27

Updated : 2026-06-17 10:03

NVD link : CVE-2025-71244

Mitre link : CVE-2025-71244

CVE.ORG link : CVE-2025-71244

JSON object : View

Products Affected

spip

  • spip
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')