CVE-2026-102244

MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

State: Published
Severity: 5.3 Medium
Published: Sep 29, 2026
Updated: Sep 29, 2026
Reserved: Sep 28, 2026

Description

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
SurfSenseMODSetter	0.0.1Affected 0.0.2Affected 0.0.3Affected 0.0.4Affected 0.0.5Affected 0.0.6Affected 0.0.7Affected 0.0.8Affected 0.0.9Affected 0.0.10Affected 0.0.11Affected 0.0.12Affected 0.0.13Affected 0.0.14Affected 0.0.15Affected 0.0.16Affected 0.0.17Affected 0.0.18Affected 0.0.19Affected 0.0.20Affected 0.0.21Affected 0.0.22Affected 0.0.23Affected 0.0.24Affected 0.0.25Affected and 12 more versions

References

VDB-411142 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgeryvdb-entry
VDB-411142 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-102244 | CVE Analysis and Reportthird-party-advisory
Submit #933330 | MODSetter SurfSense <=0.0.36 Server-Side Request Forgerythird-party-advisory
https://gist.github.com/DReazer/57126e711507324a547edde96c62c218exploit
https://github.com/MODSetter/SurfSense/commit/2faff7b3823322a9cb6797973e6caf089386c354patch
https://github.com/MODSetter/SurfSense/releases/tag/0.0.36.3patch
https://github.com/MODSetter/SurfSense/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.