Description

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-13T12:17:28.330Z",
  "pubdate": "2026-08-13T12:17:28.330Z",
  "executiveSummary": "A server-side request forgery vulnerability exists in Serendipity before version 2.6.0 within the serendipity_url_allowed() filter mechanism. The flaw permits authenticated users possessing the adminImagesAdd permission to bypass URL filtering restrictions by supplying alternate address formats, specifically hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. This architectural weakness enables unauthorized interactions with internal network services and allows threat actors to retrieve sensitive response bodies through the public uploads directory. The risk implications include internal reconnaissance, potential exposure of sequestered microservices, and unauthorized data exfiltration within the hosting perimeter. Successful exploitation requires administrative media management privileges, authenticated session access, and the ability to submit crafted Uniform Resource Identifiers to the vulnerable validation function.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and normalization within the serendipity_url_allowed() filter function responsible for vetting external resource locations. The root cause is the filter's failure to adequately parse and restrict non-standard IP address representations, specifically omitting checks for hexadecimal-encoded IPv4 notations, raw IPv6 address literals, and reserved link-local address ranges. Attackers leverage these omitted formats to bypass blacklist or whitelist restrictions enforced by the application logic. The vulnerable component resides in the URL validation routines governing media retrieval processes. Affected versions comprise all Serendipity releases prior to 2.6.0. The attack flow initiates when an authenticated user with the adminImagesAdd privilege submits a maliciously crafted URL utilizing an alternative IP encoding scheme to the application. Because the serendipity_url_allowed() function fails to recognize the encoded representation as a local or restricted resource, the validation check passes successfully. The underlying server then initiates an outbound network request via protocols supported by the backend transport layer to the resolved internal destination. Upon connection establishment, the targeted internal service processes the request and returns the corresponding response body to the Serendipity application. The application subsequently writes or exposes this retrieved data through the public uploads directory, allowing the attacker to access the response payload. Post-exploitation impact encompasses unauthorized data retrieval from internal services, server-side request smuggling primitives, and potential interaction with internal APIs that lack secondary authentication mechanisms behind the perimeter firewall."
}