SSRF via Hex-Encoded Addresses in URL Validation Filter

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-73629 is a server-side request forgery (SSRF) vulnerability in Serendipity's URL validation filter that fails to properly sanitize alternate IPv4 and IPv6 address formats. Authenticated users with adminImagesAdd permissions can exploit this by encoding internal IP addresses in hexadecimal notation or using IPv6 literals to bypass security controls, allowing them to request internal services and exfiltrate sensitive data through the public uploads directory. This affects any Serendipity installation before version 2.6.0 where such users exist, potentially exposing internal APIs, cloud metadata endpoints, and other services meant to be isolated from external access.

Casky's 331 matching skills—powered by Claude's extended reasoning across 754 MITRE ATT&CK-mapped security techniques—would detect this attack pattern by analyzing reconnaissance activity (TA0001) associated with internal network enumeration and resource discovery, combined with exploitation tactics (TA0006) that reveal attempts to bypass input validation filters. Practitioners using Casky would observe findings flagged around anomalous URL parameter patterns containing hex-encoded addresses, unusual IPv6 literals in upload requests from authenticated admin accounts, repeated requests to internal service ranges (127.x.x.x, 169.254.x.x, or ::1), and suspicious response exfiltration through the uploads directory. The platform's reasoning would correlate these signals with CWE-918 patterns to identify the validation bypass technique before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-73629.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-73629

Casky has 331 skills that investigate the attack patterns behind CVE-2026-73629. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn