Read the docs
TI-2026-65290 Aliases CVE-2026-102244GHSA-m6qw-8q66-9vp2

MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

Priority MEDIUM 57CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.0.36.3 is recommended to address this issue. The patch is named 2faff7b3823322a9cb6797973e6caf089386c354. The affected component should be upgraded.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed SurfSense (MODSetter): 0.0.36.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MODSetterSurfSense0.0.1; 0.0.2; 0.0.3; 0.0.4; 0.0.5; 0.0.6; 0.0.7; 0.0.8; 0.0.9; 0.0.10; 0.0.11; 0.0.12; 0.0.13; 0.0.14; 0.0.15; 0.0.16; 0.0.17; 0.0.18; 0.0.19; 0.0.20; 0.0.21; 0.0.22; 0.0.23; 0.0.24; 0.0.25; 0.0.26; 0.0.27; 0.0.28; 0.0.29; 0.0.30; 0.0.31; 0.0.32; 0.0.33; 0.0.34; 0.0.35; 0.0.360.0.36.3Patch availableCNA
  • SurfSense VendorMODSetter Affected 0.0.1; 0.0.2; 0.0.3; 0.0.4; 0.0.5; 0.0.6; 0.0.7; 0.0.8; 0.0.9; 0.0.10; 0.0.11; 0.0.12; 0.0.13; 0.0.14; 0.0.15; 0.0.16; 0.0.17; 0.0.18; 0.0.19; 0.0.20; 0.0.21; 0.0.22; 0.0.23; 0.0.24; 0.0.25; 0.0.26; 0.0.27; 0.0.28; 0.0.29; 0.0.30; 0.0.31; 0.0.32; 0.0.33; 0.0.34; 0.0.35; 0.0.36 Fixed in 0.0.36.3 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*——MODSetter
  • cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:* Versions — — ·MODSetter

Remediation

  • Fix · CNA SurfSense (MODSetter) Fixed in 0.0.36.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102244
  2. 2026-10-03 Alias added: GHSA-m6qw-8q66-9vp2

References

Exploit 1

Patch 2

Other 1

  • TI-2026-65291 MODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication CVSS 4.0MEDIUM 6.9
  • TI-2026-65289 MODSetter SurfSense MCP Connector Integration test command injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences