CVE-2026-73629
HIGH
NVD
CVSS Score
8.5
Severity
HIGH
Published
Aug 13, 2026
Vendor
unknown
Description
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.