CVE-2026-73628

Medium

Description

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

SeverityMedium

CVSS6.1

Exploit probability—

Product

Serendipity

PublishedAug 13, 2026

First seenAug 13, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Vendor advisories

github.com/s9y/Serendipity/security/advisories/GHSA-6c2x-mjmq-vx4q

Affected products

Product	Affected versions	Fixed in
s9y Serendipity	2.3.5 ≤ v ≤ 2.6.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.