CVE-2026-73628 in Serendipity
Summary
by MITRE • 08/13/2026
Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists in Serendipity blogging platform versions 2.3.5 through 2.6.0 where the sanitization pipeline processes user input in an insecure order that creates a path for cross-site scripting attacks. The flaw is located in the include/functions_routing.inc.php file within the serveSearch() function where the sequence of security operations is improperly ordered. Specifically, the application first applies HTML encoding to user-supplied content and then performs URL decoding, which allows malicious payloads that have been URL-encoded to bypass the sanitization filters and execute as active code in the victim's browser context.
The technical implementation of this vulnerability stems from a fundamental flaw in input validation processing where the order of operations creates an exploitable condition. When attackers craft search queries containing URL-encoded HTML entities that have been HTML-escaped, the subsequent URL decoding operation restores these entities to their original form, effectively neutralizing the protective measures provided by strip_tags() and htmlspecialchars() functions. This represents a classic case of improper input sanitization where the security controls are applied in the wrong sequence, allowing malicious content to penetrate through the defenses.
The operational impact of this vulnerability is significant as it enables attackers to execute arbitrary JavaScript code within the context of any user's browser session who visits a compromised search result page. This creates a persistent cross-site scripting attack vector that can be exploited to hijack sessions, steal cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. The vulnerability affects all versions between 2.3.5 and 2.6.0, making it a widespread concern for installations that have not been updated to the patched version 2.6.1.
The remediation involves correcting the input sanitization pipeline by ensuring that URL decoding occurs before HTML encoding operations, or by implementing proper validation that prevents URL-encoded payloads from bypassing security filters. Security practitioners should immediately upgrade to Serendipity version 2.6.1 which contains the necessary fixes for this vulnerability. Organizations maintaining older versions should implement additional input validation measures and consider deploying web application firewalls to mitigate potential exploitation attempts. This vulnerability aligns with CWE-79 (Cross-site Scripting) and follows ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) in its exploitation methodology, representing a critical security weakness that requires immediate attention.
The vulnerability demonstrates how seemingly minor issues in input processing order can create significant security risks. The improper sequence of sanitization operations creates a condition where HTML encoding followed by URL decoding allows attackers to craft payloads that survive standard security controls. This type of vulnerability is particularly dangerous because it operates at the application level and can be exploited through user interaction with search functionality, making it difficult to detect and prevent without proper input validation. The fix implemented in version 2.6.1 addresses the root cause by reordering the sanitization operations to ensure that malicious payloads are properly neutralized before any decoding operations occur, thereby preventing the execution of arbitrary JavaScript code in victim browsers.