What is CVE-2026-73629?
CVE-2026-73629 is a server-side request forgery (SSRF) vulnerability in Serendipity versions before 2.6.0. The serendipity_url_allowed() filter fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges, allowing authenticated users with adminImagesAdd permission to bypass the filter. Upgrade to Serendipity 2.6.0 to mitigate this issue.
Azərbaycanca: CVE-2026-73629, Serendipity-nin 2.6.0-dan əvvəlki versiyalarında aşkarlanmış server tərəfli sorğu saxtakarlığı (SSRF) zəifliyidir. serendipity_url_allowed() filtrindəki boşluq səbəbilə autentifikasiya olunmuş adminImagesAdd icazəli istifadəçilər hex kodlu IPv4, IPv6 ünvanları və link-local aralıqları istifadə edərək filtri keçə bilərlər. Serendipity-ni 2.6.0 versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
Is authentication required to exploit CVE-2026-73629?
Yes, this vulnerability can only be exploited by authenticated users with adminImagesAdd permission.
What version should be upgraded to in order to mitigate the CVE-2026-73629 SSRF vulnerability?
Upgrade to Serendipity version 2.6.0 to mitigate this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.