Executive brief
Serendipity, a popular open-source blogging platform, contains a security flaw in its link-tracking component. An attacker can create a malicious link that appears to belong to a trusted blog but instead redirects the visitor to a harmful external website. This can be used to trick users into visiting phishing sites or downloading malware by exploiting the reputation of the legitimate blog domain.
Technical details
An open redirect vulnerability exists in the `exit.php` file of Serendipity when the `serendipity_event_trackexits` plugin is enabled and configured with `commentredirection` set to `s9y`. The application accepts a user-controlled Base64-encoded string via the `url` parameter and performs a redirect without sufficient validation of the destination. An unauthenticated remote attacker can exploit this by crafting a URL that leverages the trusted domain to redirect victims to arbitrary external sites. This bypasses URL reputation filters and facilitates phishing or malware delivery. The issue is resolved in version 2.6.1.
Affected products
- s9y Serendipity < 2.6.1
Timeline
- 2026-07-27: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD