Description

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T12:17:28.183Z",
  "pubdate": "2026-08-13T12:17:28.183Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists within Serendipity versions ranging from 2.3.5 through 2.6.0. The flaw resides in the search clean-URL routing mechanism, specifically affecting the search term handling. If successfully exploited, an attacker can execute arbitrary JavaScript within the context of a victim's browser session by tricking them into clicking a crafted URL. This security deficiency exposes users to session hijacking, credential theft, and unauthorized actions performed on their behalf. The vulnerability stems from improper sanitization ordering, where decoding operations occur after security filtering has already been applied. Exploitation requires user interaction, typically via social engineering tactics such as phishing or malicious link distribution over networks. The issue poses a moderate to high risk depending on the sensitivity of the targeted user sessions and the privilege level of the authenticated victim. Remediation requires upgrading the software to the patched version where the input sanitization pipeline has been corrected to prevent secondary decoding of malicious payloads.",
  "technicalDetails": "The vulnerability is classified as a reflected cross-site scripting flaw occurring within the search clean-URL route designated as /search/<term>. The vulnerable component resides in the source file include/functions_routing.inc.php, specifically inside the serveSearch() function. The root cause of the vulnerability is an insecure sanitization pipeline execution order. During request processing, the application applies strip_tags() and htmlspecialchars() functions to neutralize potential markup before executing a urldecode() operation. Because urldecode() is executed subsequent to the initial HTML encoding and stripping phase, a single URL-encoded HTML payload can successfully bypass the protective filters. Specifically, the encoded characters survive the security checks and are subsequently decoded back into raw, live HTML strings when rendered in the response page. The attack flow begins when an attacker crafts a malicious URL containing a URL-encoded script payload within the search term parameter. The attacker then induces a victim to navigate to this crafted link over the network. Upon receiving the request, the Serendipity routing engine processes the search term through the flawed sanitization pipeline in include/functions_routing.inc.php. The payload bypasses strip_tags() and htmlspecialchars() due to the premature encoding, and the subsequent urldecode() function translates the string into executable HTML and JavaScript structures. When the server reflects this unvalidated input back into the Document Object Model (DOM) of the response, the victim's browser parses and executes the embedded script. No authentication or elevated privileges are required to initiate this attack, making it exploitable against any unauthenticated visitor interacting with the publicly accessible search route. The post-exploitation impact includes the execution of arbitrary script logic in the victim browser, potentially leading to session token exfiltration, DOM manipulation, or actions performed under the authority of the authenticated user."
}