SPIP CVE-2026-109378

Exploitation requires an authenticated SPIP account (PR:L) with the ability to configure a remote-fetching feature - specifically a syndicated site feed or a remote document URL processed by recuperer_url() in ecrire/inc/distant.php. The attacker must control (or redirect through) an external server that returns an HTTP redirect to an internal or link-local target; the flaw is that redirects (up to 10) are followed without re-invoking valider_url_distante(), so the initial URL passes validation while the redirect target does not. Impact against cloud metadata endpoints is maximized only when SPIP is hosted in a cloud environment that exposes a metadata service (e.g., 169.254.169.254). Limiting factors: valid authentication is mandatory, exploitation depends on the site exposing feed/remote-document functionality to that account, and the SSRF is read/confidentiality-oriented (no integrity or availability impact).

This is a genuine but moderate-priority issue, best characterized as a high-signal-but-constrained SSRF rather than a drop-everything emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with a base score of 5.3 (Medium) aligns well with the description: network-reachable, low attack complexity, no user interaction, but requiring low-level privileges (PR:L). The PR:L requirement is the key risk-limiter - an attacker must already hold an authenticated SPIP account able to configure syndicated feeds or remote documents, which excludes fully anonymous internet-wide exploitation. Impact is scoped to confidentiality of a subsequent system (VC:L/SC:L, with VI/VA/SI/SA all None), consistent with reading cloud metadata or internal endpoints rather than full RCE or data destruction. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active or automated exploitation; the signals are internally consistent and point to a real-but-targeted risk. The one elevated concern is the explicit mention of cloud metadata endpoints (e.g., 169.254.169.254), which in a cloud-hosted SPIP deployment could escalate a low-impact SSRF into credential theft - defenders in cloud environments should weight this higher than the base 5.3 suggests. No conflicting signals were found between the CVSS vector and the description.

An attacker with a low-privileged authenticated SPIP account configures a syndicated site feed or remote document pointing to an attacker-controlled server, which issues an HTTP redirect to an internal or link-local address such as the cloud metadata endpoint. Because recuperer_url() follows up to 10 redirects without re-calling valider_url_distante(), SPIP fetches the internal resource on the attacker's behalf and may return sensitive metadata (e.g., cloud instance credentials). No public exploit code was identified at time of analysis.