EUVD-2026-31601
GHSA-r5pm-523h-5x7q
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.
AnalysisAI
Open redirect in SPIP's ecrire subsystem allows authenticated remote attackers with low privileges to redirect victims to arbitrary external URLs via the action/cookie.php endpoint, affecting all SPIP versions prior to 4.4.15. The CVSS score of 3.5 (Low) is consistent with EPSS at 0.03% (7th percentile) and SSVC's determination of no exploitation and partial technical impact, making this a low-urgency but patchable flaw. No public exploit identified at time of analysis, and CISA KEV does not list this vulnerability.
Technical ContextAI
SPIP is a PHP-based open-source content management system widely used for multilingual web publishing. The vulnerability resides in action/cookie.php within ecrire - SPIP's core administrative scripting layer that handles authentication state, including cookie-based session management. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) describes a class of flaw where user-controlled input is used to construct a redirect destination without sufficient allowlist validation, enabling an attacker to route users to external, attacker-controlled sites. The CPE string cpe:2.3:a:spip:spip:*:*:*:*:*:*:*:* covers all SPIP versions through 4.4.14. The fix spans two repositories: a commit in spip/spip (75629034) and a commit in spip/ecrire (a22cb8a5), indicating the root cause touches both the core distribution and the ecrire subsystem independently.
RemediationAI
The primary fix is upgrading to SPIP 4.4.15 or later, which resolves the open redirect in action/cookie.php. The vendor published a security release announcement at https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-15.html?lang=fr, with the underlying code changes documented at https://git.spip.net/spip/spip/-/commit/75629034697ab52a963a340afd10930407e1cd55 (core repository) and https://git.spip.net/spip/ecrire/-/commit/a22cb8a56f1e37ff3854b73ff3f66aa3df47070a (ecrire subsystem). If immediate upgrade is not feasible, a compensating control would be to restrict access to action/cookie.php via web server rules (e.g., nginx location block or Apache FilesMatch directive) to allowlisted IP ranges only - note this may impair SPIP's cookie-based authentication for legitimate users. A WAF rule enforcing that redirect parameters in requests to cookie.php match only the application's own domain is a less disruptive alternative but requires WAF capability.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Share
External POC / Exploit Code
Leaving vuln.today