CVE-2026-73629 in Serendipity
Summary
by MITRE • 08/13/2026
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within the Serendipity content management system prior to version 2.6.0 where the serendipity_url_allowed() filter implementation contains a critical flaw that permits server-side request forgery attacks. The security weakness stems from inadequate validation of URL address formats, specifically failing to properly block hex-encoded IPv4 addresses that can be used to bypass the intended filtering mechanism. The vulnerability extends beyond simple IP address validation to include IPv6 literals and link-local network ranges that are commonly used for internal network communication but should not be accessible through external public interfaces.
The technical exploitation of this flaw occurs through authenticated administrative users who possess the adminImagesAdd permission level, allowing them to upload malicious content that can trigger the vulnerable filter. Attackers can leverage alternate address formats such as hexadecimal representations of IPv4 addresses or IPv6 literal notation to circumvent the security controls and make requests to internal services that would normally be restricted. This bypass capability enables unauthorized access to internal network resources that are typically protected behind firewalls or network segmentation policies.
The operational impact of this vulnerability represents a significant risk to organizations using Serendipity CMS versions prior to 2.6.0, as it provides attackers with the ability to perform reconnaissance and potentially exfiltrate sensitive information from internal services. The exploitation process allows for retrieval of response bodies through the public uploads directory, meaning that even if the initial request fails, any data returned by internal services can be accessed by the attacker through the publicly exposed upload functionality. This creates a persistent threat vector that can be used to gather intelligence about internal network topology and potentially access sensitive data hosted on internal servers.
The vulnerability aligns with CWE-918 which specifically addresses server-side request forgery vulnerabilities, and maps to ATT&CK technique T1071.004 for application layer protocol exploitation. Organizations should immediately upgrade to Serendipity version 2.6.0 or later where the URL filtering has been properly implemented to reject all non-standard address formats including hex-encoded IPs, IPv6 literals, and link-local ranges. Additional mitigations include implementing network segmentation to isolate internal services from public-facing interfaces, enforcing strict firewall rules to restrict access to internal resources, and monitoring upload directories for suspicious activity that may indicate exploitation attempts. The security patch addresses the root cause by implementing comprehensive validation of URL address formats while maintaining proper filtering of both IPv4 and IPv6 address types to prevent similar bypass techniques from succeeding in future versions.