CVE-2026-85687 Details
Description
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.
A vulnerability allowing unauthenticated arbitrary file read has been identified in Surya version 0.22.1. The issue resides in the screenshot server, which is a Flask application that binds to all network interfaces without authentication. The vulnerability is present in the '/info', '/page', and '/process' routes, which accept raw 'file_path' parameters. Attackers can exploit this by providing arbitrary file paths to 'Image.open' or 'pypdfium2.PdfDocument', thereby reading any image or PDF file on the host. The rendered contents are returned as base64, and the '/info' route can be used to verify the existence of files.
To address this vulnerability, it is recommended to confine the 'file_path' parameter to an allowed directory, rejecting absolute paths and any attempts to traverse directories. Implementing authentication for the screenshot server or binding it to the loopback interface by default would also enhance security.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/datalab-to/surya | [email protected] | Source CodeVendor |
| https://github.com/datalab-to/surya/blob/v0.22.1/surya/scripts/screenshot_app.py | [email protected] | Source CodeVendor |
| https://github.com/datalab-to/surya/issues/518 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/surya-0.22.1-unauthenticated-arbitrary-file-read-via-screenshot-server | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| datalab-to surya | <= 0.22.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |