CVE-2026-73628: Serendipity 2.3.5 Reflected XSS via search clean-URL route
Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functionsrouting.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives striptags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Serendipityto a version that resolves this vulnerability.Fixed in 2.6.1 - Upgrade
Upgrade
Serendipityto a version that resolves this vulnerability.Fixed in 2.3.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73628?
CVE-2026-73628 has a medium severity rating of 6.1.
How do I fix CVE-2026-73628?
To mitigate CVE-2026-73628, upgrade your Serendipity installation to a version above 2.6.0.
What type of vulnerability is CVE-2026-73628?
CVE-2026-73628 is a reflected cross-site scripting (XSS) vulnerability.
Which versions of Serendipity are affected by CVE-2026-73628?
CVE-2026-73628 affects Serendipity versions from 2.3.5 to 2.6.0.
Where does the vulnerability CVE-2026-73628 occur?
CVE-2026-73628 occurs in the search clean-URL route in the serveSearch() function of include/functions_routing.inc.php.