SPIP before version 4.4.18 contains a server‑side request forge vulnerability in the function recuperer_url() located in ecrire/inc/distant.php. The function follows up to ten HTTP redirects without re‑validating the target URI against the allowed list. An attacker who can authenticate to the site can supply a remote URL that redirects to internal or link‑local addresses, such as cloud metadata endpoints. This allows the authenticated user to force the server to access internal resources, potentially exposing confidential data and enabling further exploitation of internal services.

All installations of SPIP running a version earlier than 4.4.18 are affected. The vulnerability is present in every release prior to the 4.4.18 security update from the SPIP project.

The CVSS score of 5.3 labels the flaw as medium severity. Exploitation requires user authentication but does not require privileged or kernel‑level access on the server. Because the platform can reach internal networks, the potential impact could include data theft or internal service compromise. No evidence of exploitation is reported in the KEV catalog and the EPSS score is unavailable, but because the flaw provides a gateway to internal systems, administrators should treat it as a tangible risk when an authenticated attacker is present.