Executive brief
SPIP, a popular open-source content management system, is vulnerable to an open redirect flaw in its cookie handling component. An attacker could use this to redirect users from a legitimate site to a malicious external website, which is often used in phishing campaigns to steal credentials. This issue affects versions prior to 4.4.15 and could damage a site's reputation by facilitating fraud.
Technical details
An open redirect vulnerability exists in SPIP's 'ecrire' administration interface within the action/cookie.php file. The root cause is the processing of the 'url_echec' request parameter, which was identified as legacy code that failed to properly validate redirection targets. An attacker with low privileges can provide a crafted URL that causes the application to redirect users to an arbitrary external domain. This vulnerability is fixed in version 4.4.15 by removing the unused and insecure 'url_echec' logic.
Affected products
- SPIP SPIP < 4.4.15
Timeline
- 2026-05-22: patched: SPIP version 4.4.15 released
- 2026-05-24: disclosed: CVE-2026-48832 published