SurfSense EUVD-2026-88618

Requires an authenticated low-privilege account on SurfSense (PR:L) and access to the Document Export Feature (POST to the export_document route in editor_routes.py). The SSRF is reachable through the server-side export/conversion pipeline (pypandoc/typst) that processes document content - an attacker must supply document content containing a URL or reference that the server dereferences during export. Limiting factors: valid authentication is needed (not exploitable pre-auth), no user interaction beyond the attacker's own request (UI:N), and impact is confidentiality-limited (VC:L) with no integrity/availability effect. Versions up to 0.0.36 are affected; 0.0.36.3 removes the server-side PDF/typst export path, reducing the exposed conversion surface.

This is a genuinely low-severity issue despite being remotely reachable. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L/VI:N/VA:N, base 2.1) reflects that exploitation requires an authenticated low-privilege user (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability impact - consistent with a classic SSRF that lets an attacker coax the server into making outbound requests but does not, on its own, expose secrets wholesale or corrupt/deny service. Exploitation signals: POC is publicly available (VulDB gist by DReazer, E:P), a patch exists (0.0.36.3, commit 2faff7b3), but there is no EPSS score and no CISA KEV entry provided, so this is 'publicly available exploit code exists' rather than confirmed active exploitation. No SSVC decision data (Exploitation/Automatable/Technical Impact) was supplied. Net: this is a low-priority, low-impact SSRF in a niche product - public exploit code raises opportunistic risk slightly, but the authentication requirement and confidentiality-only impact keep real-world risk modest. Note the source-code evidence: the fix removed the entire server-side PDF/typst export path rather than adding URL/SSRF filtering, so the reachable SSRF surface appears tied to the pandoc/typst conversion pipeline fetching remote resources embedded in exported documents.

An authenticated low-privilege SurfSense user submits a document for export whose content embeds an attacker-chosen URL (e.g., an internal metadata endpoint or intranet host); the backend export pipeline in editor_routes.py fetches that resource server-side, letting the attacker probe or reach internal network services from the server's vantage point. A public proof-of-concept (VulDB/DReazer gist) exists, and because the attack complexity is low (AC:L) it is straightforward to reproduce once authenticated.