CVE-2026-73629
Received Received - Intake

Serendipity SSRF via Hex-Encoded IP Filter Bypass

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73629
EUVD
EUVD-2026-57798

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
serendipity serendipity to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Serendipity versions before 2.6.0. The serendipity_url_allowed() filter fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter to request internal services and retrieve response bodies through the public uploads directory.

Detection Guidance

Check Serendipity version with: grep -r "serendipity_version" /path/to/serendipity/install. If version is below 2.6.0, it is vulnerable. Review server logs for unusual uploads to /uploads/ directory from internal IPs or hex-encoded addresses.

Test for SSRF attempts by sending crafted URLs with hex IPv4 (e.g., 0x7f000001), IPv6 (e.g., ::1), or link-local addresses (e.g., 169.254.169.254) to the upload endpoint. Monitor for outbound requests to internal services.

Impact Analysis

An attacker could exploit this to access internal services, retrieve sensitive data like AWS EC2 instance metadata, and persist the response as a media file. This could lead to unauthorized access to internal systems and potential data leaks.

Mitigation Strategies

Upgrade Serendipity to version 2.6.1 or later immediately. Remove adminImagesAdd permission from non-admin users until patched. Block outbound requests to internal IP ranges at the firewall level.

Review and remove any suspicious files in the /uploads/ directory. Implement strict URL validation in serendipity_url_allowed() to reject hex-encoded, IPv6, and link-local addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart