CVE-2026-102244
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A security flaw was discovered in MODSetter SurfSense up to 0.0.36 in the file surfsense_backend/app/routes/editor_routes.py of the Document Export Feature. Manipulation results in server-side request forgery. The attack can be initiated remotely, and the exploit is public. Upgrading to version 0.0.36.3 is recommended.
Risk Assessment
The organization is at risk of the server being used to attack internal network resources, potentially leading to data exposure or further compromise.
Recommendation
Upgrade SurfSense to version 0.0.36.3 or later. Restrict access to the document export feature and monitor network traffic.
Other vulnerabilities in MODSetter SurfSense
Original NVD description (English source)
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS