What is CVE-2026-73628?
CVE-2026-73628 is a reflected cross-site scripting (XSS) vulnerability affecting Serendipity versions 2.3.5 through 2.6.0. It occurs in the search clean-URL route (/search/<term>) within the include/functions_routing.inc.php serveSearch() function, where the sanitization pipeline applies urldecode() after HTML encoding, allowing a single URL-encoded HTML payload to bypass sanitization. Users should update Serendipity to the latest version.
Azərbaycanca: CVE-2026-73628 Serendipity blog platformasının 2.3.5 ilə 2.6.0 versiyaları arasında aşkarlanmış reflected cross-site scripting (XSS) zəifliyidir. Bu zəiflik /search/<term> təmiz URL marşrutunda, include/functions_routing.inc.php faylındakı serveSearch() funksiyasının sanitizasiya mərhələsində HTML kodlaşdırmasından sonra urldecode() tətbiq edilməsi səbəbindən yaranır. İstifadəçilərə Serendipity-ni ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which versions of Serendipity are affected by CVE-2026-73628?
This vulnerability affects Serendipity versions 2.3.5 through 2.6.0.
What is the root cause of the reflected XSS vulnerability in CVE-2026-73628?
The flaw stems from the serveSearch() function in include/functions_routing.inc.php, where the sanitization pipeline applies urldecode() after HTML encoding in the /search/<term> clean-URL route.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.