CVE-2026-102244 in SurfSense
Summary
by MITRE • 09/29/2026
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
A critical server-side request forgery vulnerability has been identified in MODSetter SurfSense, specifically affecting versions up to 0.0.36 within the Document Export Feature module. This flaw resides in an unknown function located in the file surfsense_backend/app/routes/editor_routes.py and allows remote attackers to manipulate backend processes by forcing the server to send requests to unintended destinations. The vulnerability stems from insufficient validation of user-supplied input used during document export operations, enabling adversaries to craft malicious payloads that trick the application into making HTTP or HTTPS requests on their behalf. This class of flaw is formally categorized under CWE-918 in the Common Weakness Enumeration standard as Server-Side Request Forgery, which highlights the risk associated with applications fetching resources from user-controlled URLs without proper sanitization or allowlisting mechanisms.
The operational impact of this vulnerability is significant due to its remote exploitability and the potential for data exfiltration or internal network reconnaissance. Since the attack can be initiated remotely over a network connection, an unauthenticated attacker could potentially access sensitive internal services that are not exposed to the public internet but are reachable from the server hosting SurfSense. This capability allows attackers to probe internal infrastructure, extract confidential documents stored on local servers, or interact with other backend microservices such as authentication endpoints or database interfaces. The fact that a working exploit has already been released publicly further escalates the risk profile, indicating that automated attacks targeting this specific version are likely occurring in real-time against exposed instances of the software.
From an offensive security perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates techniques related to Discovery and Collection phases, such as T1046 Network Service Scanning or T1537 Transfer Data to Cloud Account if combined with external exfiltration channels. The lack of strict input validation on the export functionality creates a direct pathway for lateral movement within compromised environments where SurfSense is integrated into broader enterprise workflows. Organizations relying on this feature must recognize that even seemingly benign administrative functions like document exporting can serve as vectors for severe compromise when security controls are absent or misconfigured.
To mitigate this risk, immediate action is required to upgrade MODSetter SurfSense to version 0.0.36.3 or later, which incorporates the necessary code changes identified in patch commit 2faff7b3823322a9cb6797973e6caf089386c354. This update addresses the underlying logic flaw by implementing stricter validation rules for URLs and resource identifiers passed to the export module, ensuring that only whitelisted domains or local resources are permitted during document generation processes. In addition to upgrading, administrators should review access controls around the editor routes endpoint to ensure it is not exposed unnecessarily to untrusted networks. Implementing network-level restrictions such as firewall rules limiting outbound connections from the application server can also provide a defense-in-depth layer against successful exploitation attempts while patch deployment is underway.