CVE-2026-85687

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-73

Affected software

VendorProductVersions
datalab-tosurya<= 0.22.1

References

Timeline

Published
Sep 4, 2026
Last modified
Sep 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-856889.8TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpointsCVE-2026-856896.5llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup valuesCVE-2026-85698.3Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escCVE-2026-856907.8Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project diCVE-2026-856917.5MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-suppCVE-2026-856926.5Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vulnerability in the isPCVE-2026-856936.5Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private fiCVE-2026-856948.1LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted langCVE-2026-856959.4FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register CVE-2026-856969.8SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffCVE-2026-856976.5Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. ACVE-2026-856985.5Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader that uses an attacker-controlled cell-c
CVE-2026-85687: High severity, CVSS 7.5 | Vulnix