CVE-2026-85687 in surya
Summary
by MITRE • 09/04/2026
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Surya version 0.22.1 represents a critical unauthenticated Arbitrary File Read flaw affecting the core document processing endpoints of the application. This security defect is located within the handling of raw file_path parameters passed to the /info, /page, and /process routes. The underlying technical mechanism relies on the improper validation or sanitization of user-supplied input before it is utilized by backend libraries such as PIL (Pillow) for image processing via Image.open or pypdfium2 for PDF rendering via PdfDocument. Because these endpoints do not enforce strict path constraints, an attacker can inject arbitrary file system paths into the request parameters. This allows the application to bypass intended access controls and read files from any location on the host operating system where the service is executed, provided that the process has sufficient permissions to access those files.
From a technical perspective, this vulnerability stems directly from CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The application fails to restrict file operations to a specific, safe directory structure, instead allowing the operating system's native file resolution mechanisms to resolve relative and absolute paths provided by the client. When an attacker supplies a path such as /etc/passwd or C:\Windows\System32\drivers\etc\hosts, the underlying libraries attempt to open and process this file. The vulnerability is particularly severe because it affects multiple endpoints (/info, /page, /process), providing redundant attack vectors that increase the likelihood of successful exploitation. Furthermore, the use of these routes as an existence oracle via the /info endpoint allows attackers to enumerate files by observing differences in response codes or content length when attempting to read existing versus non-existing paths, facilitating targeted attacks against sensitive configuration files or credentials stored on disk.
The operational impact of this vulnerability is significant, enabling unauthenticated remote code execution scenarios indirectly through data exfiltration and system reconnaissance. An attacker can extract sensitive information such as environment variables, database connection strings, private keys, source code containing hardcoded secrets, and other confidential documents residing on the server. This capability effectively compromises the confidentiality integrity of the entire host infrastructure hosting the Surya service. In cloud or containerized environments, this could lead to lateral movement if credentials found in configuration files allow access to internal services like databases or message queues. The ability to read arbitrary files also aids attackers in mapping the file system structure, identifying other vulnerable applications running on the same host, and gathering intelligence for further exploitation phases such as privilege escalation or persistent backdoor installation.
This vulnerability aligns with MITRE ATT&CK techniques related to Data from Local System Retrieval (T1083) and potentially File Discovery (T1083.001). The lack of authentication required to exploit this flaw classifies it under CWE-287: Improper Authentication, as the system fails to verify the identity of the user before granting access to sensitive file resources. To mitigate this risk immediately, organizations should apply vendor-provided patches if available or upgrade to a version where input validation for file paths is strictly enforced. In the interim, network-level controls such as Web Application Firewalls can be configured to block requests containing path traversal sequences like ../ or absolute paths in parameters associated with these endpoints. Additionally, running the Surya service within a restricted container environment with minimal filesystem permissions and using chroot jails can limit the blast radius of any successful exploitation by preventing access to critical system directories outside the application's designated working directory.