CVE-2026-27472

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Server-Side Request Forgery (SSRF) pada spip. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-9.html release notes · advisory vendor
• https://www.vulncheck.com/advisories/spip-blind-server-side-request-forgery-via-syndicated-sites advisory pihak ketiga
• https://git.spip.net/spip/spip product