Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker's domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.
References
| Link | Resource |
|---|---|
| https://github.com/s9y/Serendipity/releases/tag/2.6.0 | Patch |
| https://github.com/s9y/Serendipity/security/advisories/GHSA-458g-q4fh-mj6r | Exploit Vendor Advisory Mitigation |
Configurations
Configuration 1 (hide)
|
History
23 Apr 2026, 13:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:s9y:serendipity:*:*:*:*:*:*:*:* cpe:2.3:a:s9y:serendipity:2.6.0:beta1:*:*:*:*:*:* |
|
| References | () https://github.com/s9y/Serendipity/releases/tag/2.6.0 - Patch | |
| References | () https://github.com/s9y/Serendipity/security/advisories/GHSA-458g-q4fh-mj6r - Exploit, Vendor Advisory, Mitigation | |
| First Time |
S9y serendipity
S9y |
15 Apr 2026, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-15 04:17
Updated : 2026-04-23 13:59
NVD link : CVE-2026-39971
Mitre link : CVE-2026-39971
CVE.ORG link : CVE-2026-39971
JSON object : View
Products Affected
s9y
- serendipity
CWE
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')