Is CVE-2026-48832 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48832 being exploited in the wild.

How severe is CVE-2026-48832?

Low severity, with a CVSS score of 3.5, published 24 May 2026.

Is there a fix for CVE-2026-48832?

A patch was published on 2026-05-22: SPIP version 4.4.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48832 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48832?

Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48832: SPIP open redirect in action/cookie.php

CVE-2026-48832 · Severity: low · CVSS 3.5 · Published 2026-05-24

SPIP, a popular open-source content management system, is vulnerable to an open redirect flaw in its cookie handling component. An attacker could use this to redirect users from a legitimate site to a malicious external website, which is often used in phishing campaigns to steal credentials. This issue affects versions prior to 4.4.15 and could damage a site's reputation by facilitating fraud.

Technologies: Spip. Vendors: Spip.

Quick answers

Is CVE-2026-48832 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48832 being exploited in the wild.
How severe is CVE-2026-48832?: Low severity, with a CVSS score of 3.5, published 24 May 2026.
Which products and versions are affected?: Spip < 4.4.15.
Is there a fix for CVE-2026-48832?: A patch was published on 2026-05-22: SPIP version 4.4.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48832 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48832?: Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in SPIP's 'ecrire' administration interface within the action/cookie.php file. The root cause is the processing of the 'url_echec' request parameter, which was identified as legacy code that failed to properly validate redirection targets. An attacker with low privileges can provide a crafted URL that causes the application to redirect users to an arbitrary external domain. This vulnerability is fixed in version 4.4.15 by removing the unused and insecure 'url_echec' logic.

Affected products

SPIP SPIP < 4.4.15

Timeline

2026-05-22: patched: SPIP version 4.4.15 released
2026-05-24: disclosed: CVE-2026-48832 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.