Is CVE-2026-102244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102244 being exploited in the wild.

How severe is CVE-2026-102244?

Medium severity, with a CVSS score of 4.3, published 29 September 2026.

Which products and versions are affected?

MODSetter SurfSense up to 0.0.36.

Is there a fix for CVE-2026-102244?

A patch was published on 2026-09-29: Fix available in version 0.0.36.3 (commit 2faff7b3823322a9cb6797973e6caf089386c354) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102244 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102244?

Check whether you run MODSetter SurfSense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102244: MODSetter SurfSense server-side request forgery in document export

CVE-2026-102244 · Severity: medium · CVSS 4.3 · Published 2026-09-29

SurfSense is a privacy-focused note-taking application with document export functionality. An authenticated user can exploit the export feature to read arbitrary files from the backend server or make the backend fetch content from internal networks, potentially exposing sensitive system files like /etc/passwd. The vulnerability requires user registration and login, but any registered user can trigger it by creating a note with specially crafted content.

Technologies: MODSetter SurfSense. Vendors: MODSetter.

Quick answers

Is CVE-2026-102244 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102244 being exploited in the wild.
How severe is CVE-2026-102244?: Medium severity, with a CVSS score of 4.3, published 29 September 2026.
Which products and versions are affected?: MODSetter SurfSense up to 0.0.36.
Is there a fix for CVE-2026-102244?: A patch was published on 2026-09-29: Fix available in version 0.0.36.3 (commit 2faff7b3823322a9cb6797973e6caf089386c354) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102244 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102244?: Check whether you run MODSetter SurfSense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Server-side request forgery (SSRF) vulnerability in the document and report export endpoints (surfsense_backend/app/routes/editor_routes.py and reports_routes.py) that pass user-controlled Markdown to Pandoc with --embed-resources flag. The backend fetches image URLs without validation of URI schemes or destinations, allowing file:// URIs for local file disclosure and http:// URIs for full-read SSRF. Attack requires authentication but no additional user interaction; exploitation is triggered via API calls to create a note and export it as HTML.

Affected products

MODSetter SurfSense up to 0.0.36

Timeline

2026-08-16: disclosed: Proof of concept published on GitHub Gist
2026-09-29: advisory
2026-09-29: patched: Fix available in version 0.0.36.3 (commit 2faff7b3823322a9cb6797973e6caf089386c354)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.