Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85687surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

High 7.5

In plain English

A high-severity security flaw in surya from datalab-to. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.

Affected products (as reported)

Vendor	Product	Versions
datalab-to	surya	0 – through 0.22.1

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #518 issue-tracking
https://github.com/datalab-to/surya product
https://github.com/datalab-to/surya/blob/v0.22.1/surya/scripts/screenshot_app.py technical-description
VulnCheck Advisory: surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server third-party-advisory