CVE-2026-73629: Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipityurlallowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2026-73629?
CVE-2026-73629 is a server-side request forgery vulnerability in Serendipity prior to version 2.6.0 that allows authenticated users to bypass URL filters.
What is the severity of CVE-2026-73629?
CVE-2026-73629 has a severity rating of 8.5, which indicates a high level of risk.
How do I fix CVE-2026-73629?
To fix CVE-2026-73629, upgrade Serendipity to version 2.6.0 or later, where the vulnerability has been patched.
Who is affected by CVE-2026-73629?
Authenticated users with adminImagesAdd permission in Serendipity versions before 2.6.0 are affected by CVE-2026-73629.
What are the implications of CVE-2026-73629?
CVE-2026-73629 could allow attackers to make unauthorized requests to internal services by exploiting the server-side request forgery vulnerability.