CVE catalog

CVE-2026-27472

UBUNTU-CVE-2026-27472

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

SPIP before 4.4.9 allows Blind Server-Side Request Forgery (SSRF) via syndicated sites in the private area. When editing a syndicated site, the application does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to make the server issue requests to arbitrary internal or external destinations. This vulnerability is not mitigated by the SPIP security screen.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspip134.4.10+dfsg-1vulnerable
Debianspip134.4.3+dfsg-1vulnerable
Debianspip134.4.3+dfsg-1+deb13u1vulnerable
Debianspip134.4.4+dfsg-1vulnerable
Debianspip134.4.5+dfsg-1vulnerable
Debianspip134.4.6+dfsg-1vulnerable
Debianspip134.4.7+dfsg-1vulnerable
Debianspip134.4.8+dfsg-1vulnerable
Debianspip134.4.9+dfsg-1vulnerable
Debianspip134.4.11+dfsg-0+deb13u1fixed
Debianspip144.4.3+dfsg-1vulnerable
Debianspip144.4.4+dfsg-1vulnerable
Debianspip144.4.5+dfsg-1vulnerable
Debianspip144.4.6+dfsg-1vulnerable
Debianspip144.4.7+dfsg-1vulnerable
Debianspip144.4.8+dfsg-1vulnerable
Debianspip144.4.9+dfsg-1fixed
Ubuntuspippro3.2.4-1vulnerable
Ubuntuspippro3.2.5-1vulnerable
Ubuntuspippro3.2.7-1vulnerable
Ubuntuspippro3.2.7-1ubuntu0.1vulnerable
Ubuntuspippro3.2.7-1ubuntu0.1+esm2vulnerable
Ubuntuspip22.043.2.11-3vulnerable
Ubuntuspip22.043.2.12-1vulnerable
Ubuntuspip22.044.0.2-1vulnerable
Ubuntuspip22.044.0.4-1vulnerable
Ubuntuspip24.044.1.11+dfsg-1vulnerable
Ubuntuspip24.044.1.12+dfsg-1vulnerable
Ubuntuspip24.044.1.13+dfsg-1vulnerable
Ubuntuspip24.044.1.15+dfsg-1vulnerable
Ubuntuspip24.044.2.9+dfsg-2vulnerable
Ubuntuspip25.104.3.8+dfsg-1vulnerable
Ubuntuspip25.104.4.3+dfsg-1vulnerable
Ubuntuspip26.044.4.3+dfsg-1vulnerable
Ubuntuspip26.044.4.6+dfsg-1vulnerable
Ubuntuspip26.044.4.7+dfsg-1vulnerable
Ubuntuspip26.044.4.8+dfsg-1vulnerable
Ubuntuspip26.044.4.9+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspipdeb134.4.11+dfsg-0+deb13u1Not reportedDEBIAN-CVE-2026-27472Not reported
Debianspipdeb144.4.9+dfsg-1Not reportedDEBIAN-CVE-2026-27472Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [spip]Fixed
    Details (9)

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.15+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.19+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.20+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.21+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.23+dfsg-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

    • 4.4.28+dfsg-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 4.4.11+dfsg-0+deb13u1

      pypi · spip · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]