Is CVE-2026-109378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109378 being exploited in the wild.

How severe is CVE-2026-109378?

Medium severity, with a CVSS score of 4.3, published 12 October 2026.

Is there a fix for CVE-2026-109378?

Yes: fixed in 4.4.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109378 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109378?

Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109378: SPIP server-side request forgery in recuperer_url()

CVE-2026-109378 · Severity: medium · CVSS 4.3 · Published 2026-10-12

SPIP is a web content management system used to build and manage websites. This vulnerability allows authenticated attackers to cause the application to make requests to internal or cloud metadata endpoints by supplying a malicious URL that redirects through multiple hops. An attacker could potentially extract sensitive cloud credentials or access internal services not intended for external use.

Technologies: Spip. Vendors: Spip.

Quick answers

Is CVE-2026-109378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109378 being exploited in the wild.
How severe is CVE-2026-109378?: Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?: Spip before 4.4.18.
Is there a fix for CVE-2026-109378?: Yes: fixed in 4.4.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109378 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109378?: Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.4.18

Technical details

The recuperer_url() function in ecrire/inc/distant.php follows up to 10 HTTP redirects without re-validating that the target URL is safe, only validating the initial URL with valider_url_distante(). Authenticated attackers can supply a remote URL (such as a syndicated feed or remote document) that redirects to internal, link-local, or cloud metadata addresses. The fix validates remote URLs at each redirect step.

Affected products

SPIP SPIP before 4.4.18

Timeline

2026-08-10: disclosed
2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.