Serendipity CMS EUVD-2026-57798

Exploitation requires an authenticated Serendipity session with the adminImagesAdd permission, which is the specific capability gating the vulnerable image URL submission workflow. The attacker must know or discover the public uploads directory path to retrieve the exfiltrated response body. The target internal service must be reachable from the Serendipity application server over HTTP/HTTPS, making cloud-hosted instances with accessible metadata services (e.g., 169.254.169.254) or deployments adjacent to internal APIs the highest-risk environments. Exploitation is bounded by the Serendipity version - only instances prior to 2.6.0 are affected. Unauthenticated exploitation is not possible given the PR:L requirement. Deployments where the uploads directory is not publicly accessible will prevent response exfiltration even if the SSRF itself succeeds.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.4, reflecting network-accessible, low-complexity exploitation requiring only a low-privilege authenticated session. The subsequent-system high confidentiality impact (SC:H) indicates that internal services - cloud metadata endpoints, internal APIs, or adjacent microservices - can be read in full. Real-world risk is meaningful for internet-facing Serendipity deployments in cloud or hybrid environments where IMDSv1 (AWS, GCP, Azure metadata) or internal services are reachable from the application server. The requirement for adminImagesAdd permission is a genuine limiting factor: this is not a guest or subscriber-level permission, meaning mass exploitation against arbitrary users is not plausible. However, any contributor-level account or compromised credential with this permission is sufficient. No EPSS score was provided; KEV status is not confirmed; and no POC has been identified, so immediate mass exploitation risk is lower than the CVSS score alone suggests. The CVSS integrity metrics (VI:L, SI:L) are consistent with the uploads directory write path but the primary real-world concern is confidentiality exfiltration.

An attacker who has obtained or registered a Serendipity account with adminImagesAdd privileges submits an image addition request using a hex-encoded IPv4 URL such as http://0xa9fea9fe/ (representing the AWS metadata endpoint 169.254.169.254) that passes the serendipity_url_allowed() filter undetected. The Serendipity server fetches the metadata response and writes it to the public uploads directory; the attacker then makes a direct HTTP GET to the known uploads path to retrieve the cloud instance credentials or internal API tokens contained in the response. No public POC has been identified at time of analysis, but the technique is well-documented in SSRF literature and requires no specialized tooling.