Threats affecting pkg:github/s9y/Serendipity

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

Serendipity versions prior to 2.6.0 contain a vulnerability where the HTTP Host header is improperly sanitized before being inserted into the Message-ID SMTP header during email sending. This allows an attacker controlling the Host header to inject arbitrary SMTP headers into outgoing emails, potentially enabling identity spoofing, reply hijacking, and email reputation abuse. The issue is fixed in version 2.6.0.

Serendipity versions prior to 2.6.0 contain a vulnerability where the function serendipity_setCookie() uses the HTTP Host header without validation when setting cookies. This allows an attacker who can manipulate the Host header during login to cause authentication cookies to be scoped to an attacker-controlled domain. The vulnerability enables session fixation, token leakage, and potential privilege escalation if an administrator logs in under a manipulated Host header. The issue is fixed in version 2.6.0.