CVE-2026-73629

Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

We have discovered 492 live websites that are affected by CVE-2026-73629.

Run a Free Instant Scan



Affected Software

Product  Serendipity
Category Content Management System
Vulnerable Domains492 live websites (85% of Serendipity install base)
Vulnerable Versions
  • from 0 through 2.6
Vulnerable Versions Count39 versions ( 95% of all versions)



Details

  • Published - Aug 13, 2026
  • Updated - Aug 14, 2026

Credits

  • riodrwn (reporter)

Website Distribution by Country

Number of websites using CVE-2026-73629
United States82 websites


Germany275 websites
Netherlands23 websites
GB14 websites
Switzerland12 websites
France10 websites
Italy6 websites
Australia6 websites
Japan6 websites
Austria5 websites

Website Distribution by TLD

Number of websites using CVE-2026-73629
.de212 websites
.com99 websites
.net44 websites
.org31 websites
.info13 websites
.nl11 websites
.co.uk10 websites
.ch9 websites
.at7 websites
.be4 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-73629

Top websites that are affected by CVE-2026-73629. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.**********.de United States***,***
***********.de Germany***,***
***********.de Germany***,***
****************.de Germany***,***
******.****************.org United States***,***
*********************.de Germany***,***
*.*******.com Japan***,***
*********.**.uk United States***,***
*********.********.****.fr France*,***,***
*****.nl Netherlands*,***,***
See full domain list

FAQ

A total of 492 websites have been identified as vulnerable to CVE-2026-73629, based on global website indexing conducted by WebTechSurvey.
The Serendipity is affected by the CVE-2026-73629 vulnerability.
Serendipity versions up to 2.6 are vulnerable to CVE-2026-73629.
CVE-2026-73629 is resolved in version 2.6 of Serendipity.