CVE-2026-48832: SPIP Open Redirect Vulnerability

CVE-2026-48832 Overview

CVE-2026-48832 is an open redirect vulnerability in action/cookie.php within the ecrire directory of SPIP, a French open-source content management system. The flaw affects SPIP versions before 4.4.15 and is classified under CWE-601: URL Redirection to Untrusted Site. Authenticated attackers can craft URLs that redirect users to attacker-controlled destinations after passing through a trusted SPIP host. The vulnerability supports phishing campaigns and social engineering attacks by leveraging the legitimate appearance of the SPIP domain.

Critical Impact

Authenticated attackers can abuse the action/cookie.php endpoint to redirect users from a trusted SPIP site to arbitrary external URLs, enabling phishing and credential theft.

Affected Products

• SPIP versions prior to 4.4.15
• SPIP ecrire administrative interface
• SPIP action/cookie.php endpoint

Discovery Timeline

• 2026-05-24 - CVE-2026-48832 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-48832

Vulnerability Analysis

The vulnerability resides in action/cookie.php, a script in the SPIP ecrire (editorial) backend responsible for cookie-related actions. The endpoint accepts a redirect parameter without sufficiently validating that the target URL points to an internal SPIP resource. An attacker who can induce an authenticated user to click a specially crafted link can redirect the victim to an external attacker-controlled domain.

Open redirects are commonly chained with phishing kits. The victim sees a legitimate SPIP hostname in the original URL, which lends credibility to the destination page. The destination page can mimic the SPIP login form to harvest credentials, deliver malware, or facilitate OAuth-style consent attacks.

The scope-changed scoring reflects that the redirect crosses a trust boundary: the SPIP application acts as a forwarder to an untrusted resource, impacting users beyond the vulnerable component itself.

Root Cause

The root cause is missing or insufficient validation of the redirect destination parameter in action/cookie.php. SPIP did not enforce an allow-list of internal hosts or constrain the redirect target to relative paths, allowing absolute external URLs to be accepted.

Attack Vector

Exploitation requires the attacker to hold valid low-privilege credentials within the SPIP backend and to convince a target user to follow a crafted link. The high attack complexity reflects the need for a chained social-engineering step. No code is executed on the SPIP server itself; the impact is confined to integrity of the navigation flow and downstream user trust.

Readers seeking the precise patched code should consult the upstream commits at SPIP Commit a22cb8a56f1e and SPIP Commit 7562903469.

Detection Methods for CVE-2026-48832

Indicators of Compromise

• Web access logs containing requests to ecrire/action/cookie.php with redirect, url, or similar parameters pointing to external domains.
• Referer headers from the SPIP host immediately preceding visits to suspicious or newly-registered domains.
• Unexpected outbound HTTP 302 responses from the SPIP application to non-allow-listed hosts.

Detection Strategies

• Parse HTTP server logs for requests to action/cookie.php whose redirect target contains a scheme (http://, https://) or // prefix rather than a relative path.
• Correlate authenticated SPIP backend sessions with subsequent external redirects to identify suspicious editor accounts.
• Deploy web application firewall (WAF) rules that flag absolute external URLs supplied to internal redirect endpoints.

Monitoring Recommendations

• Enable verbose access logging on the ecrire/ directory and forward logs to a centralized analytics platform.
• Alert on phishing-related domain reputation hits in outbound proxy logs sourced from links emailed to SPIP users.
• Track failed and successful authentications against SPIP editor accounts to detect credential abuse following potential phishing.

How to Mitigate CVE-2026-48832

Immediate Actions Required

• Upgrade all SPIP installations to version 4.4.15 or later, as announced in the SPIP Security Update Announcement.
• Audit SPIP editor and administrator accounts for unfamiliar users and rotate credentials where compromise is suspected.
• Educate editorial staff to verify the final destination of links that pass through ecrire/action/cookie.php.

Patch Information

The SPIP project addressed the issue in version 4.4.15. The fix is delivered in commits a22cb8a56f1e and 75629034697a, which constrain the redirect target in action/cookie.php to internal SPIP locations.

Workarounds

• Restrict access to the ecrire/ administrative path by IP allow-list at the reverse proxy or web server level until patching is complete.
• Add a WAF rule blocking requests to ecrire/action/cookie.php where redirect parameters contain external URL schemes.
• Enforce multi-factor authentication on SPIP editor accounts to reduce the value of credentials harvested via phishing landing pages.

# Example nginx rule to block external redirect targets on the vulnerable endpoint
location = /ecrire/action/cookie.php {
    if ($arg_redirect ~* "^(https?:)?//") {
        return 403;
    }
    proxy_pass http://spip_backend;
}