This vulnerability allows an attacker to trigger server‑side requests from the Surfsense backend, effectively performing SSRF. The flaw resides in the Document Export Feature route and can cause the server to make arbitrary HTTP requests to internal or external services, potentially leaking sensitive data, manipulating internal systems, or causing unintended actions. The impact covers confidentiality, integrity, and availability of the services the backend interacts with.

MODSetter’s SurfSense application, versions up to 0.0.36, is affected. The issue is in the file surfsense_backend/app/routes/editor_routes.py that handles Document Export requests.

The CVSS score of 5.3 indicates a moderate severity vulnerability, and the EPSS score is currently not disclosed, with the vulnerability omitted from the KEV catalog. The attack can be launched remotely, and an exploit has already been released publicly. A likely attack path is for an unauthenticated attacker to craft a request that causes the server to perform outbound requests to arbitrary hosts, potentially exploiting internal network resources. Given the public nature of the exploit and the ease of remote initiation, the risk to affected deployments remains significant.