CVE-2026-85687: surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server
surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when the screenshot server is reachable without authentication and can access image or PDF files on the host. The affected routes are /info, /page, and /process.
What does an attacker need to exploit this issue?
An attacker needs network access to the unauthenticated screenshot server and a file path to target. No credentials or user interaction are required.
What can an attacker learn or retrieve?
An attacker can obtain rendered contents of image and PDF files as base64 data. The /info route can also be used as an existence oracle for file paths.