CVE-2026-73629

CVE-2026-73629 affects Serendipity before 2.6.0. The issue is a server-side request forgery in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using ...