CVE-2026-73629

CVE-2026-73629 is a server-side request forgery (SSRF) bypass in Serendipity's image fetching feature. The application implements an allowlist filter (`serendipity_url_allowed()`) that checks whether a requested URL resolves to a private IP address — but this validation runs in PHP application code while the actual HTTP request executes through a lower-level HTTP client. The bypass exploits this parser boundary: the filter checks for '127.0.0.1' as a string, but the HTTP client resolves `0x7F000001` (hex-encoded 127.0.0.1) to the same loopback address, passing the validation while bypassing the security intent. This isn't a case of developer negligence. The filter exists at all — someone understood SSRF risk, wrote defensive code, and tested it against the obvious case. The failure is structural: IP address representation has dozens of RFC-compliant formats (hex, IPv6 literals, IPv4-in-IPv6, link-local notation), and no amount of string matching can enumerate them under normal development pressure. The knowledge that hex-encoded bypasses work has been public since at least 2014 — OWASP SSRF prevention guidance documents this. But the knowledge lives in reference documentation, not in the developer's workflow at the moment they wrote the filter. The validation layer and the HTTP client have different parsing models, and that mismatch is architectural, not fixable by more careful string matching. The permission gate (`adminImagesAdd` required) limits exploitation to authenticated administrators. In typical single-admin Serendipity deployments, this means the attacker already has significant access — the SSRF concern is that they can now reach internal services (metadata databases, admin interfaces, local network resources) that the application could fetch but the user shouldn't direct. The CVSS 8.5 rating reflects this post-authentication but high-impact path. What you should check: whether your Serendipity deployment is on a version that includes the patch (verify `serendipity_url_allowed()` correctly handles encoded address formats). If you're on an unpatched version, restrict the `adminImagesAdd` permission to the minimum necessary accounts. More broadly, treat application-layer IP allowlists as incomplete defenses — the right architectural fix is using a URL validation library that has already absorbed these bypasses, rather than rolling custom string matching against the HTTP client's implicit parsing behavior.

Reviewed through automated stages and approved by a human before publication.