PT-2026-32967 · Unknown · Serendipity

Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-39971

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.0

Description The email sending functionality in include/functions.inc.php inserts the $ SERVER['HTTP HOST'] variable directly into the Message-ID SMTP header without validation. The sanitization function serendipity isResponseClean() is not applied to the HTTP HOST variable before it is embedded. An attacker who can control the Host header during email-triggering actions, such as comment notifications or subscription emails, can inject arbitrary SMTP headers into outgoing emails. This allows for identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse by embedding an attacker-controlled domain in legitimate mail headers. This can also enable spam relay and BCC injection.

Recommendations Update to version 2.6.0.

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-39971

GHSA-458G-Q4FH-MJ6R

Affected Products

Serendipity

References · 6

• https://github.com/s9y/Serendipity/releases/tag/2.6.0 · Patch
• https://github.com/s9y/Serendipity/security/advisories/GHSA-458g-q4fh-mj6r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39971 · Security Note
• https://osv.dev/vulnerability/GHSA-458g-q4fh-mj6r · Vendor Advisory
• https://github.com/s9y/Serendipity · Note
• https://twitter.com/CVEnew/status/2044338865247506758 · Twitter Post