What’s Vulnerable › Vulnerabilities

CVE-2026-73629: Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-10-24
• Weakness: CWE-918

Description

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

Affected products

• s9y Serendipity: before 2.6.0 — fixed in 2.6.0

How to fix

Upgrade to a fixed version: s9y Serendipity 2.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/s9y/Serendipity/security/advisories/GHSA-2m48-gjj5-5x86
• https://www.vulncheck.com/advisories/serendipity-before-ssrf-via-hex-ipv4-and-ipv6-addresses

Get alerted when CVE-2026-73629 or the next vulnerability affects your stack