Serendipity CMS CVE-2026-73628

Exploitation requires that the target Serendipity installation is running a version between 2.3.5 and 2.6.0 inclusive, and that the clean-URL routing mode is active so that the /search/<term> route is handled by serveSearch() in include/functions_routing.inc.php - the vulnerable decode-after-encode pipeline only exists in that code path. The attacker requires no authentication and no account on the site. Exploitation is bounded by the requirement for victim interaction: the victim must follow a crafted link while their browser holds an active session on the targeted Serendipity site. The realistic impact ceiling is determined by the victim's privilege level - if the victim is an anonymous visitor the attacker gains little; if the victim is an authenticated administrator, the attacker can leverage the stolen session to modify site content or escalate further through normal admin capabilities.

The CVSS 4.0 base score of 5.3 reflects a medium-severity, network-accessible flaw that requires victim interaction (UI:P) - a meaningful constraint that limits opportunistic mass exploitation. Attack complexity is low and no privileges are required, so any external attacker can craft the malicious URL without an account on the target site. No EPSS data was supplied and the vulnerability does not appear in CISA KEV, and no public exploit code has been identified at time of analysis, together suggesting the flaw has not been broadly weaponized. Even so, a mid-sized municipal IT team in sanok running a public-facing Serendipity blog should treat this as a meaningful operational risk, since reflected XSS is trivially weaponized for session hijacking and phishing via spear-targeted links. Impact on confidentiality and integrity of both the vulnerable and subsequent browser session is rated Low, consistent with scope-limited session attacks rather than server-side compromise. The primary real-world risk is session cookie theft or credential harvesting against authenticated site administrators, which could escalate to full CMS compromise through normal admin functions.

An attacker constructs a URL of the form https://target-site.example/search/%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E and delivers it to a logged-in Serendipity administrator via a phishing email or embedded link. When the administrator clicks the link, the application decodes the payload after sanitization, rendering the script tag in the page and exfiltrating the session cookie to an attacker-controlled host. No public proof-of-concept has been identified, but the attack pattern is elementary and replicable from the description alone.