Description
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| s9y | Serendipity | < 2.6.0 | 2.6.0 |
References
- GitHub Security Advisory (GHSA-2m48-gjj5-5x86) vendor-advisory
- VulnCheck Advisory: Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses third-party-advisory