A server‑side request forgery flaw exists in the serendipity_url_allowed() filter of Serendipity before version 2.6.0. The filter incorrectly accepts hex‑encoded IPv4 addresses, IPv6 literals, and link‑local ranges, allowing an attacker to craft URLs that resolve to internal network addresses. When an authenticated user possessing the adminImagesAdd permission submits such a URL, the application makes the request to the target service and then returns the response body through the public uploads directory, effectively leaking internal data to an external party.

The vulnerability affects instances of the Serendipity content management system with a version earlier than 2.6.0. Only authenticated users who have been granted the adminImagesAdd permission can exploit the flaw. No specific operating systems or platforms are listed, but the problem resides entirely in the Serendipity application code.

The CVSS score of 8.4 indicates a high level of risk. EPSS data is not available, so current exploitation likelihood cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector requires legitimate credentials with a specific permission, meaning that internal threat actors or attackers who gain privileged access can abuse the flaw. Once exploited, the attacker can obtain internal network resources or sensitive information exposed by the target service.