CVE-2026-73629

Executive Summary

CVE-2026-73629 is a server-side request forgery (SSRF) vulnerability in the Serendipity blogging platform prior to version 2.6.0. The flaw resides in the serendipity_url_allowed() filter, which fails to properly block hex-encoded IPv4 addresses, IPv6 literals, and link-local network ranges. An authenticated user possessing the adminImagesAdd permission can exploit this weakness to bypass URL validation and issue requests to internal services, retrieving response bodies through the public uploads directory. The vulnerability carries a CVSS v3.1 score of 8.5 (High) with network attack vector, low attack complexity, and high confidentiality impact, potentially exposing sensitive internal data to authenticated low-privileged attackers.

Technical Analysis

The vulnerability class is Server-Side Request Forgery (CWE-918), arising from insufficient input validation in the URL allow-list enforcement mechanism. The affected function, serendipity_url_allowed(), is designed to restrict which URLs the application may fetch on behalf of the user. This is a common SSRF protection layer used to prevent the application server from accessing internal resources (e.g., 169.254.169.254 cloud metadata, internal APIs, or localhost services).

The NVD description identifies three specific bypass vectors:

1. Hex-encoded IPv4 addresses: IPv4 addresses can be expressed in alternative numerical formats. For example, the decimal address 127.0.0.1 can be rewritten as a single hexadecimal integer (0x7F000001) or a dotted octal/hex format. If the filter performs string-based matching against canonical dotted-decimal representations, alternate encodings bypass the validation while the underlying socket still resolves to the same internal host.

2. IPv6 literals: Modern systems accept IPv6 addresses in standard notation (e.g., ::1 for localhost) and variant forms such as IPv4-mapped IPv6 addresses (::ffff:127.0.0.1) or with embedded IPv4 segments. If the allow-list does not parse and normalize IPv6 literals, they can evade the filter entirely.

3. Link-local ranges: Link-local addresses (e.g., 169.254.0.0/16 and fe80::/10) are frequently missing from blocklists. These ranges are not routable on the public internet but are reachable from internal hosts, including auto-configured cloud metadata services such as AWS IMDS.

The combined attack surface is reachable by any authenticated user with the adminImagesAdd permission — a privilege level required for uploading or fetching images by URL, a standard feature in Serendipity's media manager. The impact is amplified by the fact that the SSRF response is reflected back to the attacker through the public uploads directory, meaning the attacker can read the full response body of the internal HTTP request. This elevates the vulnerability from a simple port-scan primitive (blind SSRF) to a full read-capability SSRF.

There is insufficient technical detail available to describe the exact string-parsing logic or the precise code path leading to the write-into-uploads behavior. The description does not specify how response bodies are persisted (e.g., whether the fetched content is stored as a file, cached, or rendered directly), nor does it reveal the exact data-flow between the URL allow-list check and the fetch operation. However, the described mechanism (filter bypass → internal request → response stored in public directory) is consistent with SSRF design flaws in CMS media-import features.

Exploitation Scenarios

Target Identification: An attacker with a valid low-privileged account (e.g., content editor) scans for Serendipity installations running versions below 2.6.0. Discovery can be performed via Shodan queries targeting "Serendipity" HTTP titles or via directory fingerprinting of the /serendipity_admin.php endpoint.

Vulnerability Trigger: The attacker navigates to the media management interface and selects the "upload from URL" or "fetch remote image" functionality, which invokes the flawed serendipity_url_allowed() validation. Unique parameters or implementation specifics are not disclosed in the advisory, so the attack is described at the class level: any functionality that issues an outbound HTTP request to a user-supplied URL behind the adminImagesAdd permission gate is a candidate trigger point.

Payload / Execution Method: The attacker supplies a URL using one of the bypass formats:

• http://0x7f000001/ (hex-encoded decimal IP for 127.0.0.1)
• http://[::1]:8080/ (IPv6 loopback to internal admin interface)
• http://169.254.169.254/latest/meta-data/ (link-local cloud metadata endpoint)

Because the allow-list fails to normalize or reject these forms, the request passes validation and the application fetches the target. The web server resolves the alternate-mechanism IP to the intended internal host.

Post-Exploitation Impact: The application stores the fetched response body into the public uploads directory (e.g., /uploads/). The attacker then retrieves the saved file via a standard HTTP GET request to the public path, obtaining the full content of the internal resource. This can yield:

• AWS/cloud IAM temporary credentials from the metadata service
• Internal configuration files, database credentials, or API tokens
• Reads of other internal HTTP services (e.g., admin panels, monitoring dashboards)

The attack chain does not require privileged account compromise beyond the adminImagesAdd permission, which is typically assigned to editors and trusted authors.

Impact Assessment

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N scores 8.5 (High) and highlights several factors:

• Attack Vector (Network): The vulnerability is exploitable remotely over the network, requiring no physical or adjacent access.
• Attack Complexity (Low): The bypass formats are well-documented and require no advanced preparation beyond knowing the internal target address.
• Privileges Required (Low): Only the adminImagesAdd permission is needed, mapping to a standard editor-level account — not full administrator.
• User Interaction (None): No victim user action is required; the attacker drives the exploit entirely.
• Scope (Changed): The impact extends beyond the vulnerable component — the compromised resource is an internal server, not merely the blog application itself.
• Confidentiality (High): Full read access to internal HTTP services, including potentially sensitive metadata or credentials.
• Integrity (Low): The attacker can write the fetched content into the public uploads space, potentially poisoning the site's content with defaced or malicious content (e.g., storing an HTML page that serves client-side malware).

Blast Radius: All Serendipity deployments below 2.6.0 with the media-upload-by-URL feature enabled and at least one account holding adminImagesAdd. The internal network to which the application server has outbound reachability is also included in the blast radius — this may include cloud metadata (169.254.169.254), internal subnets, loopback services, and container orchestration APIs. Because the response is exfiltrated via a public URL, data leakage is persistent and does not require simultaneous wire-level sniffing.

Detection Guidance

The following detections focus on identifying anomalous URL formats in outgoing HTTP requests from the Serendipity application and on abnormal reads of the uploads directory.

Sigma Rule

title: Serendipity SSRF via Alternate IP Formats
id: 5a0d7bba-c9f0-4a5e-8a67-2e4f1b39bf12
status: experimental
description: Detects HTTP requests from a Serendipity server to internal IPs using hex-encoded IPv4, IPv6 literals, or link-local addresses, indicating CVE-2026-73629 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73629
author: ValtersIT Threat Intel
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection_nonstandard_host:
        request.url|contains:
            - '0x'          # hex-encoded decimal IPv4
            - '0X'          # uppercase hex marker
            - '%3A%3A1'     # URL-encoded IPv6 localhost
            - '%5B'         # URL-encoded opening bracket for IPv6 literal
            - '169.254.'    # link-local IPv4 range
            - 'fe80:'       # link-local IPv6 range
    selection_ipv6:
        request.url|contains:
            - '::1'
            - '::ffff:'
    condition: selection_nonstandard_host or selection_ipv6
falsepositives:
    - Legitimate internal health-check monitors (rare with these formats)
    - CDN or proxy testing tools using IPv6 literal notation
level: high
tags:
    - attack.t1190
    - cve.2026.73629
    - cwe.918

YARA Rule

rule CVE_2026_73629_Serendipity_SSRF_Bypass_Payload
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects payloads containing alternate IP formats targeting Serendipity SSRF (CVE-2026-73629)"
        cve = "2026-73629"
        severity = "high"
        date = "2026-01-01"

    strings:
        $hex_ipv4 = /http[s]?:\/\/0[xX][0-9a-fA-F]{1,8}\// nocase
        $ipv6_loopback = /http[s]?:\/\/\[(::1|::ffff:)/ nocase
        $linklocal_v4 = /http[s]?:\/\/169\.254\./ nocase
        $linklocal_v6 = /http[s]?:\/\/\[fe80\d*:/ nocase
        $aws_metadata = /169\.254\.169\.254/ nocase

    condition:
        any of them
}

rule CVE_2026_73629_Serendipity_Uploads_Exfil
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects suspicious bursts of GET requests to Serendipity uploads directory (response exfil path)"
        cve = "2026-73629"
        severity = "medium"
        date = "2026-01-01"

    strings:
        $upload_path = "/uploads/" nocase
        $admin_images = "adminImagesAdd" ascii

    condition:
        $upload_path and any of them and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-73629 - Serendipity SSRF alternate IP format"; flow:established,to_server; content:"GET"; http_method; http.uri; content:"0x"; http.uri; pcre:"/\/0[xX][0-9a-fA-F]+\//U"; sid:2026736291; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026-73629, cwe 918, mitre_attack T1190; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73629; classtype:attempted-recon;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-73629 - Serendipity SSRF IPv6 literal target"; flow:established,to_server; content:"GET"; http_method; http.uri; pcre:"/\[(::1|::ffff:)/U"; sid:2026736292; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026-73629, cwe 918, mitre_attack T1190; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73629; classtype:attempted-recon;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-73629 - Serendipity SSRF link-local target"; flow:established,to_server; content:"GET"; http_method; http.uri; pcre:"/(169\.254\.|fe80[0-9a-fA-F]*:)/U"; sid:2026736293; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026-73629, cwe 918, mitre_attack T1190; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73629; classtype:attempted-recon;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where event.type == "start" and
    destination.ip like "169.254.*" or
    destination.ip like "fe80:*" or
    destination.ip like "0.0.0.*" or
    destination.ip == "::1" ]
  [ http where event.category == "web" and
    http.request.uri like "*/uploads/*" and
    process.name : "php*" or process.name : "apache*" ]

Splunk SPL Query

index=proxy OR index=webserver
| search "adminImagesAdd" OR (uri_path="*/uploads/*")
| eval is_bad = case(
    match(uri,"0[xX][0-9a-fA-F]+") , "hex_ipv4",
    match(uri,"\[::1\]") , "ipv6_loopback",
    match(uri,"169\.254\.") , "linklocal_v4",
    match(uri,"fe80") , "linklocal_v6",
    true(), "normal")
| search is_bad != "normal"
| stats count by src_ip, uri, is_bad, _time
| where count > 1
| table _time, src_ip, uri, is_bad, count

Wazuh OSSEC Rule

<group name="serendipity,">
  <rule id="100817" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>GET</match>
    <regex>uri="http://(0[xX][0-9a-fA-F]+|\[::1\]|169\.254\.|fe80[0-9a-fA-F]*:)</regex>
    <description>Serendipity SSRF attempt detected: alternate IP format (CVE-2026-73629)</description>
    <group>cve.2026.73629,cwe.918,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100818" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>GET</match>
    <regex>uri="/uploads/.*\.(txt|html|json|xml)"</regex>
    <description>Suspicious read of Serendipity uploads directory (potential SSRF exfil, CVE-2026-73629)</description>
    <group>cve.2026.73629,cwe.918,attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, commit, or release containing a fix has been identified from any tracked source. As of this writing, the vendor has not published a patched version.

1. Immediate Mitigations (no patch available)

• Restrict the adminImagesAdd permission: Revoke this permission from all non-essential accounts. If the workflow allows, grant it only to a single trusted administrator account. This reduces the accessible attack surface to a minimal set of users.
• Apply egress network filtering at the host or container level: Block outbound HTTP(S) traffic from the application server to the link-local range (169.254.0.0/16), loopback (127.0.0.0/8, ::1), and the IPv6 link-local range (fe80::/10). A Web Application Firewall (WAF) with SSRF protection rules can also intercept requests containing hex-encoded or IPv6-literal hostnames.
• Disable the "fetch by URL" media feature if business needs permit: Temporarily remove the upload-by-URL option from the media interface through a plugin or configuration change until the vendor releases a patch.
• Monitor access logs for requests containing alternate IP formats and for anomalous reads of the uploads directory.

2. Patch / Upgrade Steps

• Track the Serendipity security advisory release channel. The fix is expected in version 2.6.0 or a subsequent security release.
• As soon as a fixed version is released, upgrade all production instances. Back up the database and serendipity_config_local.inc.php before performing the upgrade.
• Test the upgraded version in a staging environment that replicates the production configuration, particularly the media-upload and URL-fetch workflows.

3. Long-Term Hardening

• Subnet isolation: Place the blog application in a DMZ segment with strict outbound firewall rules. The application must only be able to reach approved external hosts (e.g., CDN endpoints) and never the internal management network.
• Proxy for outbound fetches: Modify the deployment to route all server-side HTTP fetches through an egress proxy with its own allow-list and protocol validation. This adds a defense-in-depth layer even if the application-level filter is bypassed.
• Web Application Firewall rules: Deploy WAF rules that normalize URL hostnames (converting hex, octal, and IPv6 variants to canonical form) before allow-list comparison, and block link-local destinations at the WAF layer.
• Regular security reviews: Re-audit the adminImagesAdd privilege assignments during access reviews. Consider implementing just-in-time (JIT) privilege elevation for administrative features.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73629
2. Vendor Security Advisory: https://docs.s9y.org/docs/users/security.html (pending — no advisory published at the time of writing)
3. CWE Entry (CWE-918 — SSRF): https://cwe.mitre.org/data/definitions/918.html
4. ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. PortSwigger SSRF Bypass Cheat Sheet (contextual reference for encoding bypass techniques): https://portswigger.net/web-security/ssrf

Threat Actor Activity: There is no known evidence of in-the-wild exploitation, exploit code, or Nuclei templates for this CVE at the time of this report. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the vulnerability class (SSRF with read-capability into cloud metadata) has been actively weaponized in prior CMS vulnerabilities (e.g., CVE-2019-18873, CVE-2020-5405), and the low privilege requirement (editor-level) makes this a likely candidate for use by commodity exploit kits once PoC material emerges.