Is CVE-2026-73629 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73629?

CVE-2026-73629 has a CVSS v3 severity of HIGH (8.5).

Back

CVE-2026-73629

Description

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.