Is CVE-2026-67350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67350 being exploited in the wild.

How severe is CVE-2026-67350?

Medium severity, with a CVSS score of 4.3, published 31 July 2026.

Is there a fix for CVE-2026-67350?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-67350 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-67350?

Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67350: Serendipity open redirect in exit.php

CVE-2026-67350 · Severity: medium · CVSS 4.3 · Published 2026-07-31

Serendipity, a popular open-source blogging platform, contains a security flaw in its link-tracking component. An attacker can create a malicious link that appears to belong to a trusted blog but instead redirects the visitor to a harmful external website. This can be used to trick users into visiting phishing sites or downloading malware by exploiting the reputation of the legitimate blog domain.

Technologies: Serendipity. Vendors: Serendipity.

Quick answers

Is CVE-2026-67350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67350 being exploited in the wild.
How severe is CVE-2026-67350?: Medium severity, with a CVSS score of 4.3, published 31 July 2026.
Which products and versions are affected?: Serendipity < 2.6.1.
Is there a fix for CVE-2026-67350?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-67350 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-67350?: Check whether you run Serendipity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in the `exit.php` file of Serendipity when the `serendipity_event_trackexits` plugin is enabled and configured with `commentredirection` set to `s9y`. The application accepts a user-controlled Base64-encoded string via the `url` parameter and performs a redirect without sufficient validation of the destination. An unauthenticated remote attacker can exploit this by crafting a URL that leverages the trusted domain to redirect victims to arbitrary external sites. This bypasses URL reputation filters and facilitates phishing or malware delivery. The issue is resolved in version 2.6.1.

Affected products

s9y Serendipity < 2.6.1

Timeline

2026-07-27: advisory: GitHub Security Advisory published
2026-07-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.