action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. (CVE-2026-48832)

The action/cookie.php script in the ecrire module of SPIP before version 4.4.15 contains an open redirect vulnerability. This flaw permits attackers to craft URLs that redirect users to external sites, potentially facilitating phishing or other social engineering attacks. The vulnerability has a CVSS 3.1 base score of 3.5, indicating a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change. The vulnerability impacts multiple specific SPIP versions as enumerated, including 3.0.20-1 through 4.4.14+dfsg-1 (implied by the fix in 4.4.15).

The vulnerability allows an attacker to redirect users to arbitrary external URLs, which can be leveraged for phishing or redirecting users to malicious sites. There is no direct impact on confidentiality or availability, but the integrity impact is low due to the potential for misleading users.

A fix is available in SPIP version 4.4.15 and later. Users should upgrade to version 4.4.15 or newer to remediate this open redirect vulnerability. No additional vendor advisory or patch links were provided, so users should consult official SPIP release notes or security advisories for confirmation and further guidance.