CVE-2026-27472

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27472
SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html Release Notes Vendor Advisory
https://git.spip.net/spip/spip Product
https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:27

Type Values Removed Values Added
References () https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html - Vendor Advisory, Release Notes () https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html - Release Notes, Vendor Advisory

24 Feb 2026, 19:45

Type Values Removed Values Added
CWE CWE-918
First Time Spip spip
Spip
References () https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html - () https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html - Vendor Advisory, Release Notes
References () https://git.spip.net/spip/spip - () https://git.spip.net/spip/spip - Product
References () https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites - () https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites - Third Party Advisory
CPE cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:*
Summary
  • (es) SPIP anterior a la versión 4.4.9 permite la Falsificación de Petición del Lado del Servidor Ciega (SSRF) a través de sitios sindicados en el área privada. Al editar un sitio sindicado, la aplicación no verifica que la URL de sindicación sea una URL remota válida, lo que permite a un atacante autenticado hacer que el servidor emita peticiones a destinos internos o externos arbitrarios. Esta vulnerabilidad no es mitigada por la pantalla de seguridad de SPIP.

19 Feb 2026, 19:22

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-19 19:22

Updated : 2026-06-17 10:27

NVD link : CVE-2026-27472

Mitre link : CVE-2026-27472

CVE.ORG link : CVE-2026-27472

JSON object : View

Products Affected

spip

  • spip
CWE
CWE-918

Server-Side Request Forgery (SSRF)