PT-2026-42973 · Spip · Spip

Germain Ngoyi + 1 · Published 2026-05-24 · Updated 2026-05-25 · CVE-2026-48832

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.15

Description The 'action/cookie.php' endpoint in the 'ecrire' component is subject to an open redirect, which occurs when an application redirects users to an external site without sufficient validation of the destination URL.

Recommendations Update to version 4.4.15 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-48832

Affected Products

Spip

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48832 · Security Note
• https://git.spip.net/spip/ecrire/-/commit/a22cb8a56f1e37ff3854b73ff3f66aa3df47070a · Note
• https://t.me/CVEtracker/54797 · Telegram Post
• https://git.spip.net/spip/spip/-/commit/75629034697ab52a963a340afd10930407e1cd55 · Note
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-15.html?lang=fr · Note