Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
3.x.x	✅
> 2.5	✅
< 2.4	❌

Reporting a Vulnerability

Further information on: https://docs.s9y.org/docs/contributing/index.html

Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header
GHSA-458g-q4fh-mj6r published Apr 13, 2026 by onli

High
Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php
GHSA-4m6c-649p-f6gf published Apr 13, 2026 by onli

Moderate

Learn more about advisories related to s9y/Serendipity in the GitHub Advisory Database