PT-2026-20913 · Spip · Spip

Dorian Piette · Published 2026-01-01 · Updated 2026-02-23 · CVE-2026-27472

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.9

Description SPIP versions before 4.4.9 contain a Blind Server-Side Request Forgery (SSRF) issue related to syndicated sites within the private area. The application does not validate the syndication URL when editing a syndicated site, potentially allowing an authenticated attacker to force the server to make requests to arbitrary internal or external locations. The SPIP security screen does not address this issue.

Recommendations Update to SPIP version 4.4.9 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27472

Affected Products

Spip

References · 12

• https://osv.dev/vulnerability/CVE-2026-27472 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27472 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27472 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-27472 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27472 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27472 · Vendor Advisory
• https://twitter.com/CVEnew/status/2025809106209292676 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024589250226720836 · Twitter Post
• https://vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites · Note
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html · Patch, Vendor Advisory
• https://git.spip.net/spip/spip · Note