CVE-2026-73629: s9y Serendipity

High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

Affected products

• s9y Serendipity: before 2.6.0 (fixed in 2.6.0)

Published 2026-08-13. Last modified 2026-09-09.