PT-2026-20845 · Spip · Spip

Dorian Piette · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-71247

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.9

Description SPIP before version 4.4.9 contains a Blind Server-Side Request Forgery (SSRF) issue related to syndicated sites within the private area. The application does not validate the syndication URL when editing a syndicated site, potentially allowing an authenticated attacker to force the server to make requests to arbitrary internal or external destinations. The SPIP security screen does not mitigate this issue.

Recommendations Update to SPIP version 4.4.9 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-71247

Affected Products

Spip

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-71247 · Security Note
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html · Patch, Vendor Advisory
• https://t.me/CVEtracker/45129 · Telegram Post
• https://vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites · Note
• https://git.spip.net/spip/spip · Note
• https://twitter.com/CVEnew/status/2025892062407655935 · Twitter Post