CVE-2026-73629

High

Description

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

SeverityHigh

CVSS8.5

Exploit probability—

Product

Serendipity

PublishedAug 13, 2026

First seenAug 13, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

s9y Serendipity2.6.0 or later

Vendor advisories

github.com/s9y/Serendipity/security/advisories/GHSA-2m48-gjj5-5x86

Affected products

Product	Affected versions	Fixed in
s9y Serendipity	v < 2.6.0	2.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.