CVE-2026-73628CWE-79cross-site-scripting

CVE-2026-73628

Medium · published August 13, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<term>). In include/functions_routing.inc.php serveSearch(), the sanitisation pipeline runs urldecode() after HTML-encoding, so a single URL-encoded HTML payload survives strip_tags() and htmlspecialchars() and is then decoded back into live HTML in the page. A crafted search link can execute arbitrary JavaScript in the victim's browser. Fixed in 2.6.1.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-13T16:17Z
References (3)
https://github.com/s9y/Serendipity/security/advisories/GHSA-6c2x-mjmq-vx4q · [email protected]https://www.vulncheck.com/advisories/serendipity-reflected-xss-via-search-clean-url-route · [email protected]https://github.com/s9y/Serendipity/security/advisories/GHSA-6c2x-mjmq-vx4q · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 11:28Z
    Serendipity 2.3.5 Reflected XSS via search clean-URL route
    cvelistv5