CVE-2026-102244 json
MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
published 2026-09-29 41 d ago modified 2026-09-29 40 d ago also EUVD-2026-88618
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.
Patch / fix
- MODSetter SurfSense 0.0.36.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 40 d ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/DReazer/57126e711507324a547edde96c62c218 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- MODSetter SurfSense
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/MODSetter/SurfSense/commit/2faff7b3823322a9cb6797973e6caf089386c354
patch
-
github.com
/MODSetter/SurfSense/releases/tag/0.0.36.3
patch
-
gist.github.com
/DReazer/57126e711507324a547edde96c62c218
exploit
-
vuldb.com
/vuln/411142
vdb-entry
-
vuldb.com
/vuln/411142/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-102244
third-party-advisory
-
vuldb.com
/submit/933330
third-party-advisory
-
github.com
/MODSetter/SurfSense/
product
Sources
- CVE List CVE-2026-102244
- NVD CVE-2026-102244
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.