| शीर्षक | MODSetter SurfSense <=0.0.36 Server-Side Request Forgery |
|---|
| विवरण | SurfSense 0.0.36 contains an authenticated server-side request forgery issue in the document export feature. A low-privileged registered user can cause the backend to fetch attacker-controlled URIs while rendering an export and to return the retrieved bytes in the response. This includes local files on the application host as well as HTTP endpoints reachable from the server. Successful exploitation discloses sensitive files and internal resources of the affected SurfSense instance. User interaction is not required beyond a valid session. |
|---|
| स्रोत | ⚠️ https://gist.github.com/DReazer/57126e711507324a547edde96c62c218 |
|---|
| उपयोगकर्ता | Snkn0w (UID 90071) |
|---|
| सबमिशन | 16/08/2026 12:49 PM (1 महीना पहले) |
|---|
| संयम | 28/09/2026 08:46 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 411142 [MODSetter SurfSense तक 0.0.36 Document Export Feature editor_routes.py अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|