The Screenshot server in Surya 0.22.1 accepts a raw file_path parameter on the /info, /page, and /process endpoints. Through the use of Image.open or pypdfium2.PdfDocument, the supplied path is opened and the resultant rendered content is returned as Base64. This allows an attacker to read any image or PDF file stored on the host, without authentication and with no additional prerequisites. The flaw is a classic path traversal vulnerability (CWE‑73) and can expose sensitive files or configuration data, leading to a compromise of confidentiality.

The vulnerability exists in Surya version 0.22.1, the screenshot service maintained by datalab-to. Any deployment of this version, regardless of platform, is affected. No other versions are listed as affected, but systems using 0.22.1 or lower should be considered at risk until patched.

The CVSS score of 8.7 indicates a high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but the flaw allows remote, unauthenticated access to arbitrary files. Attackers need only send HTTP requests to the vulnerable endpoints with a crafted file_path parameter, making exploitation straightforward with readily available tools or scripts. The lack of authentication or directory restrictions further lowers the effort required to read sensitive host files.