CVE-2026-73629 s9y CVE debrief

Who should care

Administrators and users of Serendipity versions before 2.6.0, especially those with adminImagesAdd permission, should assess exposure and prioritize upgrading to version 2.6.0 or later.

Why it matters

CVE-2026-73629 is a high-severity server-side request forgery vulnerability in Serendipity before 2.6.0, allowing authenticated users to bypass filters and request internal services. Defenders should prioritize upgrading to version 2.6.0 or later and restrict adminImagesAdd permission to trusted users.

• Potential unauthorized access to internal services
• Possible data breaches through response body retrieval
• Bypass of security filters using alternate address formats
• Verification of vulnerability status for Serendipity versions before 2.6.0

Technical summary

The serendipity_url_allowed() filter in Serendipity before 2.6.0 fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges, allowing authenticated users with adminImagesAdd permission to bypass the filter and request internal services through the public uploads directory. This could lead to potential unauthorized access to internal services and possible data breaches through response body retrieval. The vulnerability requires a comprehensive review of the serendipity_url_allowed() filter and its handling of various address formats.

Defensive priority

High priority for systems using Serendipity versions before 2.6.0 with adminImagesAdd permission.

Recommended defensive actions

• Upgrade Serendipity to version 2.6.0 or later
• Restrict adminImagesAdd permission to trusted users
• Monitor for suspicious activity in the public uploads directory
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in Serendipity versions before 2.6.0, allowing authenticated users with adminImagesAdd permission to bypass the serendipity_url_allowed() filter using alternate address formats.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.