SSRF Vulnerability in Serendipity serendipity_url_allowed

Serendipity versions prior to 2.6.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the serendipity_url_allowed() function. This filter is intended to validate URLs provided during administrative image uploads, but it fails to properly sanitize or restrict specific address formats. Authenticated users holding the adminImagesAdd permission can leverage this oversight to submit requests to internal network services. By utilizing hex-encoded IPv4 addresses, IPv6 literals, or link-local address ranges, an attacker can bypass existing security controls. Once the server performs the request on behalf of the attacker, the response body can be retrieved and accessed through the public uploads directory, potentially exposing sensitive internal application responses or metadata.

Impact

Successful exploitation allows authenticated administrators to perform unauthorized requests against internal infrastructure. This can be used to scan internal network segments, interact with non-public services, or exfiltrate sensitive data returned by internal APIs or web services, which is then made accessible through the public uploads directory of the Serendipity installation.

Recommendation

1. Upgrade all Serendipity instances to version 2.6.0 or higher immediately to apply the patch for CVE-2026-73629.
2. Audit user permissions for the adminImagesAdd role and restrict access to trusted administrators only to minimize the risk of internal exploitation.
3. Monitor web server access logs for unusual outbound requests originating from the Serendipity server, specifically those containing hexadecimal or IPv6-formatted destination addresses.