Serendipity 2.6.1 released!

nospam@example.com (Malte Paskuda) — Thu, 23 Jul 2026 00:54:00 +0200

Serendipity 2.6.1 is a security and bugfix release. It addresses four security issues reported to us and fixes smaller issues that were missed in 2.6.0.

Please update to 2.6.1 to get security fixes for a possible attack by duplicating existing usernames (and getting the original [admin] rights), to plug an XSS bug on the search page caused by incorrect escaping of the search term, to block access to some internal network resources when downloading files directly to the media library and to stop a possible open redirect when using the trackexit plugin and its included URL redirect via the blog installation.

2.6.1 also improves the integrated cache by deleting it more often and solving a 404 error in plugin pages caused by it, fixes a PHP 8.3 compatibility issue in the backend comment page and fixes the plugin backend administration on new installs, where a missing default value caused the Javascript to throw an error, blocking the plugin drag'n drop functionality from working.

Please see the release page on GitHub for more (technical) details and downloads.

Thanks to the reporters and contributors.