# CVE-2026-48832: SPIP open redirect in action/cookie.php

Source: https://junglewise.ai/threats/cve-2026-48832-spip-open-redirect-in-action-cookie-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-24. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-48832 · Severity: low · CVSS 3.5 · Published 2026-05-24

SPIP, a popular open-source content management system, is vulnerable to an open redirect flaw in its cookie handling component. An attacker could use this to redirect users from a legitimate site to a malicious external website, which is often used in phishing campaigns to steal credentials. This issue affects versions prior to 4.4.15 and could damage a site's reputation by facilitating fraud.

Technologies: [Spip](https://junglewise.ai/threats/technologies/spip). Vendors: [Spip](https://junglewise.ai/threats/vendors/spip).

## Quick answers

**Is CVE-2026-48832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48832 being exploited in the wild.

**How severe is CVE-2026-48832?** Low severity, with a CVSS score of 3.5, published 24 May 2026.

**Which products and versions are affected?** Spip < 4.4.15.

**Is there a fix for CVE-2026-48832?** A patch was published on 2026-05-22: SPIP version 4.4.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48832 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48832?** Check whether you run Spip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability exists in SPIP's 'ecrire' administration interface within the action/cookie.php file. The root cause is the processing of the 'url_echec' request parameter, which was identified as legacy code that failed to properly validate redirection targets. An attacker with low privileges can provide a crafted URL that causes the application to redirect users to an arbitrary external domain. This vulnerability is fixed in version 4.4.15 by removing the unused and insecure 'url_echec' logic.

## Affected products

- SPIP SPIP < 4.4.15

## Timeline

- 2026-05-22: patched: SPIP version 4.4.15 released
- 2026-05-24: disclosed: CVE-2026-48832 published

## References

- [https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-15.html?lang=fr](https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-15.html?lang=fr)
- [https://git.spip.net/spip/ecrire/-/commit/a22cb8a56f1e37ff3854b73ff3f66aa3df47070a](https://git.spip.net/spip/ecrire/-/commit/a22cb8a56f1e37ff3854b73ff3f66aa3df47070a)
- [https://git.spip.net/spip/spip/-/commit/75629034697ab52a963a340afd10930407e1cd55](https://git.spip.net/spip/spip/-/commit/75629034697ab52a963a340afd10930407e1cd55)

## Related threats

- [SPIP SQL injection via parameter mismatch](https://junglewise.ai/threats/cve-2026-122032-spip-before-4-4-29-contains-a-sql-injection-vulnerability-that)
- [SPIP server-side request forgery in recuperer_url()](https://junglewise.ai/threats/cve-2026-109378-spip-before-4-4-18-contains-a-server-side-request-forgery)
- [SPIP mass assignment in editer_objet leading to RCE](https://junglewise.ai/threats/cve-2026-72710-spip-mass-assignment-in-editer-objet-leading-to-rce)
- [SPIP missing authorization in sensitive actions](https://junglewise.ai/threats/cve-2026-72709-spip-missing-authorization-in-sensitive-actions)
- [SPIP unauthenticated blind SQL injection in SQL escaping](https://junglewise.ai/threats/cve-2026-72708-spip-unauthenticated-blind-sql-injection-in-sql-escaping)