Executive brief
Serendipity is a popular open-source blogging and content management system. A reflected cross-site scripting (XSS) vulnerability in the search feature allows attackers to craft malicious links that execute arbitrary JavaScript in a victim's browser when clicked, potentially compromising session data and user accounts. The vulnerability affects versions 2.3.5 through 2.6.0 and has been patched in version 2.6.1.
Technical details
The vulnerability is a reflected XSS in the search clean-URL handler (/search/<term>) caused by improper input sanitization in include/functions_routing.inc.php, serveSearch() function. The flaw occurs because the sanitization pipeline executes urldecode() after HTML-encoding (htmlspecialchars() and strip_tags()), allowing a URL-encoded HTML payload to survive the encoding step as inert text, then be decoded back into live HTML and injected into the page. Attack requires no privileges and is network-accessible; a victim must click a crafted link, making user interaction a requirement. An attacker can execute arbitrary JavaScript in the victim's authenticated session. The fix involves reordering the sanitization pipeline to decode first, then sanitize (or dropping urldecode() entirely if the router already decodes the input).
Affected products
- Serendipity Project Serendipity >=2.3.5, <=2.6.0
Timeline
- 2026-07-26: disclosed: GitHub Security Advisory published
- 2026-08-13: advisory: NVD and VulnCheck advisory published
- 2026: patched: Fix released in version 2.6.1