CVE-2026-73629

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.0

Description An issue exists in the serendipity url allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass this filter using alternate address formats to perform a server-side request forgery, allowing them to request internal services and retrieve response bodies through the public uploads directory.

Recommendations Update to version 2.6.0 or later.