CVE-2026-109378: SPIP Server-Side Request Forgery Vulnerability

CVE-2026-109378 Overview

CVE-2026-109378 is a Server-Side Request Forgery (SSRF) vulnerability in the SPIP content management system before version 4.4.18. The flaw resides in the recuperer_url() function within ecrire/inc/distant.php. The function follows up to 10 HTTP redirects without re-validating each redirect target through valider_url_distante(). Authenticated attackers can submit a remote URL, such as a syndicated site feed or remote document reference, that redirects to internal or link-local addresses. This includes cloud instance metadata endpoints such as 169.254.169.254. The vulnerability is classified under CWE-918.

Critical Impact
Authenticated attackers can pivot through SPIP to reach internal services and cloud metadata endpoints, exposing credentials and internal network resources.

Affected Products

SPIP versions prior to 4.4.18
SPIP installations exposing authenticated features that call recuperer_url() (syndication, remote documents)
Cloud-hosted SPIP deployments where instance metadata services are reachable

Discovery Timeline

2026-10-12 - CVE-2026-109378 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109378

Vulnerability Analysis

SPIP's recuperer_url() function in ecrire/inc/distant.php fetches remote resources on behalf of authenticated users. The function validates the initial URL supplied by the caller using valider_url_distante() to block requests to internal addresses. The validation is only applied to the first request. When the remote server responds with an HTTP 3xx redirect, SPIP follows the Location header up to 10 times without re-invoking the validator. An attacker who controls an external host can therefore satisfy the initial allowlist check and then redirect the SPIP server to an arbitrary internal destination.

The impact includes retrieval of cloud instance metadata such as AWS Instance Metadata Service version 1 (IMDSv1) responses, interaction with internal HTTP services, and reconnaissance of RFC1918 network ranges. In cloud environments, metadata responses can contain temporary IAM credentials that an attacker can exfiltrate through the SPIP response channel.

Root Cause

The root cause is incomplete input validation across the full redirect chain. The design assumes that validating the initial URL is sufficient, but HTTP redirect handling bypasses the allowlist entirely. Each hop in the redirect chain should be re-validated against the same policy as the user-supplied URL.

Attack Vector

Exploitation requires an authenticated SPIP account with access to features that call recuperer_url(), such as adding a syndicated feed or referencing a remote document. The attacker hosts a URL on an external domain that responds with an HTTP 302 redirect pointing to a target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. SPIP follows the redirect server-side and returns the fetched content through its normal processing path. Technical details are documented in the VulnCheck SSRF Advisory for SPIP.

Detection Methods for CVE-2026-109378

Indicators of Compromise

Outbound HTTP requests from SPIP web servers to link-local address 169.254.169.254 or RFC1918 ranges
Syndication sources or remote document URLs pointing to attacker-controlled domains that return HTTP 3xx responses
SPIP access logs showing authenticated users adding feeds or remote resources shortly before anomalous egress traffic
Unexpected retrieval of cloud IAM credentials from the SPIP host's metadata endpoint

Detection Strategies

Review SPIP configuration tables for syndication and remote document URLs added by non-administrative accounts
Correlate authenticated SPIP sessions with outbound HTTP requests initiated by the PHP worker process
Alert on any HTTP request from the SPIP server with a Host header matching metadata service IPs or internal CIDR blocks

Monitoring Recommendations

Enforce egress filtering on SPIP hosts and log all denied connections to internal ranges
Monitor web server and PHP-FPM logs for calls into recuperer_url() followed by anomalous DNS resolutions
Track changes to syndication feeds, backend configuration, and remote document fields in the SPIP database

How to Mitigate CVE-2026-109378

Immediate Actions Required

Upgrade SPIP to version 4.4.18 or later as described in the SPIP Security Update Announcement
Rotate any cloud IAM credentials associated with SPIP instances if SSRF activity is suspected
Restrict authenticated SPIP account provisioning and audit existing accounts with syndication privileges

Patch Information

SPIP 4.4.18 addresses CVE-2026-109378 by re-validating each redirect target in recuperer_url() through valider_url_distante(). Source code for the fix is available in the SPIP Git Repository. Administrators should apply the vendor release rather than attempting manual patches to the ecrire/inc/distant.php file.

Workarounds

Enforce IMDSv2 on AWS instances hosting SPIP to require session tokens that SSRF payloads cannot easily obtain
Block outbound requests from SPIP hosts to 169.254.169.254 and other internal CIDR ranges at the host firewall or security group
Disable or restrict SPIP syndication and remote document features for non-administrator roles until the patch is applied

bash

# Example iptables egress rule to block link-local metadata access from the SPIP host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT