CVE-2026-73628

Executive Summary

CVE-2026-73628 is a reflected cross-site scripting (XSS) vulnerability in the Serendipity weblog/CMS search clean-URL route (/search/<term>), affecting all versions from 2.3.5 through 2.6.0. The flaw is an input-sanitisation ordering bug: in include/functions_routing.inc.php, the serveSearch() routine runs urldecode() after HTML-encoding, so a URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is decoded back into live HTML in the page. An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser by luring them to a crafted search link. The NVD record states the issue is fixed in 2.6.1, but the patch-confidence tracker reports 0/4, meaning no independent patch evidence has been corroborated from vendor or OSV sources.

Technical Analysis

The vulnerability is a classic sanitisation-order flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the reflected-search functionality of Serendipity. When clean URLs are enabled, the application exposes the route /search/<term>, where <term> is reflected back into the rendered search results page. The codepath in serveSearch() attempts to neutralise HTML metacharacters with strip_tags() and htmlspecialchars(). However, the pipeline additionally invokes urldecode() after those encoding functions. Consequently, a single URL-encoded payload such as %3Cscript%3E...%3C/script%3E is first "protected" (the encoded %3C sequence contains no literal < character, so tag stripping and HTML-encoding do not neutralise it), and then the subsequent urldecode() converts %3C and %3E back into literal < and >. The decoded markup is emitted into the HTTP response body and parsed by the browser as live HTML/JavaScript.

Because the payload is carried in the URL path itself rather than in a query parameter, the attack is fully "reflected" — the malicious link is the only carrier, and no server-side state is modified. The attack surface is limited to instances running Serendipity 2.3.5 through 2.6.0 with clean-URL routing enabled, since the vulnerable route is /search/<term>. No authentication is required to trigger the reflection, and no special preconditions are needed beyond the victim opening the crafted link.

The CVSS vector (6.1 Medium) reflects the client-side nature of the flaw: network reachability, low attack complexity, no privileges required, user interaction required, and scope change (the vulnerable component is the web app, but the impact lands in the browser's origin context). Confidentiality and integrity impact are rated low; availability is unaffected. EPSS estimates exploitation probability at 0.00155 (5.1st percentile), and CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog. No public PoC, Nuclei template, or exploit code has been reported.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (reflected XSS) and the NVD description.

1. Reconnaissance / target identification. An attacker locates Serendipity instances by fingerprinting responses (Serendipity in page titles, meta-generator tags, or powered by footers) and by probing for the clean-URL search path, e.g., requesting https://target/search/test and confirming that test is reflected in the response body. Version identification can be performed via HTTP response headers or the admin login page to confirm the instance falls in the 2.3.5–2.6.0 range.

2. Flaw-class trigger. The attacker crafts a search-term URL that embeds HTML/JavaScript entirely in URL-encoded form, such as https://target/search/%3Cscript%3E...%3C/script%3E. Because the vulnerable route passes the term into serveSearch(), the sanitisation pipeline processes the encoded payload and the urldecode()-after-encoding ordering fault converts it back to live HTML.

3. Payload / execution method. The victim is delivered the crafted link via phishing email, forum post, or instant message. When the victim's browser requests the URL, the application reflects the decoded <script> element into the page without further sanitisation, and the browser executes the attacker-controlled JavaScript in the origin of the Serendipity site. Attack-class payloads may also use HTML event handlers (onerror), <iframe>, <img>, or <svg> vectors; the full scope is limited only by the single-decoding behaviour described above.

4. Post-exploitation impact. The injected JavaScript runs with the victim's session context. Typical outcomes include theft of session cookies or CSRF tokens (session hijacking), forced authenticated actions (e.g., publishing, altering posts or settings), keylogging of credentials entered into the page, and serving of phishing overlays. Because the attack requires user interaction and reflects into a single victim session, the immediate blast radius is per-victim, but a compromised administrative session can escalate to full site takeover.

Impact Assessment

Business impact centres on confidentiality and integrity of the web application's origin context. A successful attack can harvest session identifiers and perform content manipulation on behalf of the victim, which is particularly damaging for blog/CMS deployments where the editor may have administrative privileges. The CVSS subscores quantify this: network vector, low complexity, no privileges, and scope change indicate that the flaw is easily exploitable from the Internet, but the requirement for user interaction (UI:R) and the low confidentiality/integrity ratings cap the direct damage at the victim's browser session.

Affected systems are all Serendipity instances running versions >= 2.3.5 and <= 2.6.0 with the clean-URL search route enabled; instances with query-string-based search may be outside the vulnerable path. The blast radius is further influenced by the patch-confidence status: with 0/4 corroborated patch evidence, organisations cannot yet rely on an official advisory or verified package update, so the vulnerability should be treated as unpatched until the vendor release (2.6.1) is independently confirmed. The low EPSS score (0.00155) and absence of exploit-code publication suggest a low immediate in-the-wild threat level, but public disclosure of the discrepancy between "fixed in 2.6.1" and unconfirmed patching may attract researcher attention.

Detection Guidance

Detection should focus on web-server access logs and network traffic for URL-encoded HTML tag markers in /search/ paths. The following rules assume the vulnerable clean-URL route is being monitored.

Sigma Rule

title: Reflected XSS Payload in Serendipity /search/ Clean-URL Request (CVE-2026-73628)
id: 7d2b46a1-9e0f-4c13-8a52-3f9d21b77c40
status: experimental
description: Detects URL-encoded HTML/JavaScript tag markers in /search/ clean-URL requests to Serendipity, indicating attempts to exploit CVE-2026-73628.
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-stem|startswith: "/search/"
    cs-uri-stem|contains:
      - "%3C"
      - "%3c"
      - "%3E"
      - "%3e"
  payload_hint:
    cs-uri-stem|contains:
      - "script"
      - "iframe"
      - "img"
      - "svg"
      - "onerror"
  condition: selection and payload_hint
falsepositives:
  - Legitimate searches containing the literal string "%3C" (very rare)
level: medium
tags:
  - attack.t1189
  - cve.2026.73628
  - cwe.79

YARA Rule

rule Serendipity_Search_XSS_CVE_2026_73628
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects URL-encoded HTML/JavaScript payloads in Serendipity /search/ clean-URL reflected-XSS attempts (CVE-2026-73628)"
        reference = "CVE-2026-73628"
        date = "2026"
    strings:
        $search_path = "/search/" ascii wide nocase
        $enc_lt = "%3C" ascii wide nocase
        $enc_gt = "%3E" ascii wide nocase
        $script = "script" ascii wide nocase
        $img = "img" ascii wide nocase
        $iframe = "iframe" ascii wide nocase
        $event = "onerror" ascii wide nocase
    condition:
        $search_path and $enc_lt and $enc_gt and
        (1 of ($script, $img, $iframe, $event))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Serendipity /search/ Reflected XSS Attempt (CVE-2026-73628)"; flow:established,to_server; http.uri; content:"/search/"; nocase; content:"%3C"; nocase; content:"%3E"; nocase; pcre:"/\/search\/[^?]*%3[cC](script|img|iframe|svg|body)/i"; classtype:web-application-attack; sid:2026736280; rev:1; reference:cve,2026-73628;)

Elastic Detection

any where network.protocol == "http"
  and url.path like "/search/*"
  and (
    url.original like "*%3C*%3E*"
    or url.original like "*%3c*%3e*"
    or url.original like "*%253C*%253E*"
  )
  and (
    url.original like "*script*"
    or url.original like "*iframe*"
    or url.original like "*img*"
    or url.original like "*onerror*"
  )

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "/search/%")
| regex uri_path="(?i)%3[cC]"
| regex uri_path="(?i)%3[eE]"
| regex uri_path="(?i)(script|iframe|img|onerror|svg)"
| stats count earliest(_time) latest(_time) by src_ip, uri_path, status, user_agent

Wazuh OSSEC Rule

<group name="web,xss,">
    <rule id="100762" level="10">
        <decoded_as>web</decoded_as>
        <description>Serendipity CVE-2026-73628 reflected XSS payload in /search/ clean-URL request</description>
        <url>/search/</url>
        <match>%3C|%3E|%3c|%3e</match>
        <regex>%3[cC](script|img|iframe|svg|onerror)</regex>
        <group>attack.xss,web_application_attack,cve_2026_73628,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-73628 is 0/4 — no patch evidence from any tracked source despite the NVD description stating "Fixed in 2.6.1". Treat the vulnerability as unpatched until the vendor release is independently verified.

1. Immediate mitigations. Deploy a WAF or reverse-proxy rule that rejects HTTP requests whose URI path starts with /search/ and contains case-insensitive %3C or %3E (URL-encoded angle brackets), as these are the minimal markers required to weaponise the flaw. If clean URLs are not strictly required, disable the clean-URL feature to remove exposure of the /search/<term> route. Harden the response with a restrictive Content-Security-Policy (e.g., script-src 'self') as defense-in-depth against script execution even if reflection occurs.

2. Patch / upgrade steps. Obtain Serendipity version 2.6.1 from the official vendor channel, back up the database and web root, apply the upgrade, and verify the search route no longer decodes encoded HTML in reflected output. After upgrading, re-run the detection rules above against a controlled test request (e.g., /search/%3Cscript%3Etest%3C/script%3E) to confirm the payload is now neutralised. Because the patch-confidence tracker shows no corroborated source, validate the integrity of the downloaded package (checksum/signature) and monitor the vendor's advisory feed for official confirmation.

3. Long-term hardening. Maintain a repeatable patch-management process for CMS and plugin releases; subscribe to Serendipity security announcements; centralise web-server logs and enable the detection rules from this report in production monitoring. Restrict administrative access to the CMS and mandate short-lived sessions to limit the value of hijacked credentials. Re-assess this CVE's EPSS and CISA KEV status periodically, as reflected XSS payloads are commonly commoditised after PoC publication.

References

1. NVD — CVE-2026-73628: https://nvd.nist.gov/vuln/detail/CVE-2026-73628
2. MITRE CVE Record — CVE-2026-73628: https://www.cve.org/CVERecord?id=CVE-2026-73628
3. FIRST EPSS — EPSS score for CVE-2026-73628 (0.00155, 5.1% percentile): https://www.first.org/epss/
4. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-73628 not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Serendipity Project (vendor Thomas Eichmann) — official site and download channels; no independent vendor advisory or researcher blog was provided in the source data: https://www.s9y.org/

No known threat-actor campaigns or exploit-in-the-wild evidence were identified in the available data at the time of writing.