{"apiVersion":"1.0","identifier":"CVE-2026-73629","description":"Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.","publishedAt":"2026-08-13T12:17:28","lastModifiedAt":"2026-08-14T19:18:00","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73629","cvssScore":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","epssProbability":0.00189,"riskScore":0.86,"affectedProduct":"serendipity","affectedVersions":"<2.6.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73629","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73629","en":"https://www.redsauce.net/en/cves/CVE-2026-73629","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73629","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73629","de":"https://www.redsauce.net/de/cves/CVE-2026-73629","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73629","el":"https://www.redsauce.net/el/cves/CVE-2026-73629"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73629"}}