EUVD-2026-51552
GHSA-xcqg-793j-q344
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default plugin configuration prerequisite; UI:R required since victim must click; no confidentiality or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y. Attackers can craft trusted-looking URLs leveraging the legitimate blog domain to conduct phishing, deliver malware, or bypass URL reputation filters.
AnalysisAI
Open redirect in Serendipity's exit.php allows unauthenticated attackers to craft URLs on a legitimate blog domain that silently forward victims to arbitrary attacker-controlled sites. All Serendipity installations prior to version 2.6.1 are affected, but only when the Track Exits plugin is active and configured with commentredirection set to "s9y" - a non-default, explicit setting. No public exploit code and no CISA KEV listing exist at time of analysis; the CVSS 4.0 score of 2.1 reflects limited direct technical impact, though the phishing, malware-delivery, and URL-reputation-bypass potential represents meaningful real-world risk for organizations where blog domain credibility matters.
Technical ContextAI
Serendipity is an open-source PHP blogging and CMS platform (CPE: cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:*) maintained by the s9y project. The vulnerable component is exit.php, which implements outbound link tracking via the Track Exits plugin. When the plugin's commentredirection option is set to "s9y", exit.php reads a user-supplied url parameter encoded in Base64, decodes it server-side, and issues an HTTP redirect to the decoded destination without validating that the target is a trusted or whitelisted domain. CWE-601 (URL Redirection to Untrusted Site) is the root cause class: the application performs a redirect based entirely on attacker-controlled input without enforcing an allowlist or verifying the destination scheme and host. The Base64 encoding is cosmetic obfuscation, not a security control, and does not prevent crafting of malicious redirect targets.
RemediationAI
Upgrade Serendipity to version 2.6.1 or later; this is the vendor-confirmed patched release per the security advisory at https://github.com/s9y/Serendipity/security/advisories/GHSA-77rw-27c5-4hxm. If immediate upgrading is not feasible, disabling the Track Exits plugin entirely eliminates the attack surface with the trade-off of losing outbound click tracking. Alternatively, changing the commentredirection plugin setting away from "s9y" prevents the vulnerable code path from being invoked, again at the cost of the associated tracking functionality. A deeper compensating control for operators who must retain the feature is to add server-side destination validation to exit.php enforcing an allowlist of permitted redirect domains, though this requires code modification and careful maintenance to remain effective.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today