CVE-2026-67350 — Serendipity < 2.6.1 Open Redirect via exit.php
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a m…
Published: 2026-07-31 · CVSS: 2.1 · CVSS 4.0
Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y. Attackers can craft trusted-looking URLs leveraging the legitimate blog domain to conduct phishing, deliver malware, or bypass URL reputation filters.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7