Skip to main content

Serendipity CMS EUVDEUVD-2026-57798

| CVE-2026-73629 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-13 VulnCheck GHSA-fh9h-cxrw-2xj2
SSRF Serendipity
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.5 HIGH

Network SSRF via authenticated low-privilege role; scope changes because internal systems beyond Serendipity are queried; no availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 13, 2026 - 13:01 EUVD
Analysis Generated
Aug 13, 2026 - 12:36 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
HIGH 8.4

DescriptionCVE.org

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

AnalysisAI

Server-side request forgery in Serendipity before 2.6.0 allows authenticated users with the adminImagesAdd permission to probe internal network services by submitting image URLs encoded as hex IPv4 addresses, IPv6 literals, or link-local ranges that bypass the serendipity_url_allowed() filter. The server fetches the internal resource and stores the response body in the publicly accessible uploads directory, enabling exfiltration of sensitive internal data such as cloud metadata or internal API responses. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with adminImagesAdd-privileged account
Delivery
Submit image URL with hex-encoded IPv4 or IPv6 literal
Exploit
Bypass serendipity_url_allowed() filter
Execution
Server fetches internal service response
Persist
Response body written to public uploads directory
Impact
Attacker retrieves exfiltrated data via HTTP
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated Serendipity session with the adminImagesAdd permission, which is the specific capability gating the vulnerable image URL submission workflow. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.4, reflecting network-accessible, low-complexity exploitation requiring only a low-privilege authenticated session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained or registered a Serendipity account with adminImagesAdd privileges submits an image addition request using a hex-encoded IPv4 URL such as http://0xa9fea9fe/ (representing the AWS metadata endpoint 169.254.169.254) that passes the serendipity_url_allowed() filter undetected. The Serendipity server fetches the metadata response and writes it to the public uploads directory; the attacker then makes a direct HTTP GET to the known uploads path to retrieve the cloud instance credentials or internal API tokens contained in the response. …
Remediation Upgrade to Serendipity 2.6.0 or later, which patches serendipity_url_allowed() to correctly reject hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges; the vendor advisory is at https://github.com/s9y/Serendipity/security/advisories/GHSA-2m48-gjj5-5x86. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify and inventory all systems running Serendipity versions prior to 2.6.0; audit user accounts with the adminImagesAdd permission; implement network-level access controls restricting the application server from reaching internal infrastructure services. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Serendipity

View all
CVE-2023-31576 HIGH POC
8.8 May 16

An arbitrary file upload vulnerability in Serendipity 2.4-beta1 allows attackers to execute arbitrary code via a crafted
CVE-2012-2332 HIGH POC
7.5 Aug 13

SQL injection vulnerability in serendipity/serendipity_admin.php in Serendipity before 1.6.1 allows remote attackers to

CVE-2012-2331 MEDIUM POC
4.3 Aug 13

Cross-site scripting (XSS) vulnerability in serendipity/serendipity_admin_image_selector.php in Serendipity before 1.6.1
CVE-2015-6968 MEDIUM POC
6.5 Sep 16

Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.p
CVE-2016-10082 CRITICAL
9.8 Dec 30

include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Exe
CVE-2015-6943 MEDIUM POC
6.0 Sep 15

SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Seren
CVE-2020-10964 CRITICAL
9.8 Mar 25

Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed

CVE-2016-9681 MEDIUM POC
5.4 Dec 25

Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inje
CVE-2015-8603 MEDIUM POC
5.4 Jan 12

Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web scr
CVE-2017-8102 MEDIUM POC
5.4 Apr 24

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a ne
CVE-2017-5609 HIGH
8.8 Jan 28

SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users

CVE-2017-5476 HIGH
8.8 Jan 14

Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin. Rated high severity (

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-57798 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy