Unauthenticated Arbitrary File Read in surya Screenshot Server

The surya screenshot server version 0.22.1 contains a high-severity arbitrary file read vulnerability (CVE-2026-85687). The issue exists within the /info, /page, and /process routes, which accept user-supplied raw file_path parameters without proper validation or sanitization. By supplying arbitrary file paths to these endpoints, an unauthenticated attacker can leverage the application's underlying Image.open or pypdfium2.PdfDocument processing logic to read and exfiltrate image or PDF files from the underlying filesystem. Additionally, the /info route can be utilized as an existence oracle to confirm the presence of sensitive files on the host, facilitating reconnaissance prior to exfiltration. This vulnerability exposes files accessible by the user context running the surya server process.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the server's filesystem, including sensitive images or PDF documents. This can result in the exposure of confidential information, intellectual property, or system configurations, potentially leading to a broader compromise of the environment.

Recommendation

1. Patch immediately by upgrading the surya screenshot server to a version that addresses CVE-2026-85687.
2. Restrict network access to the surya server endpoints (/info, /page, /process) to trusted internal IP addresses only.
3. Conduct log reviews for anomalous requests containing directory traversal sequences or references to unexpected system file paths targeting the affected routes.