CVE-2026-73628

Name of the Vulnerable Software and Affected Versions Serendipity versions 2.3.5 through 2.6.0

Description A reflected cross-site scripting issue exists in the search clean-URL route '/search/'. Within the serveSearch() function located in include/functions routing.inc.php, the sanitization process executes urldecode() after HTML-encoding. This sequence allows a URL-encoded HTML payload to bypass strip tags() and htmlspecialchars(), which is then decoded back into active HTML on the page. An attacker can use a crafted search link to execute arbitrary JavaScript in the browser of a victim.

Recommendations Update Serendipity to version 2.6.1.