CVE-2026-40035 is a critical vulnerability in the obsidianforensics product 'unfurl' up to version 2025.08. The flaw arises from improper input validation in the config parsing logic that enables Flask debug mode by default. Specifically, the debug configuration value is read as a string and passed directly to Flask's app.run() method. Since any non-empty string evaluates as truthy in Python, this results in debug mode activation unintentionally. This exposes the Werkzeug debugger interface, which can be exploited by attackers to disclose sensitive application information or execute arbitrary code remotely. The CVSS 4.0 score is 9.3, reflecting the high impact and ease of exploitation without authentication or user interaction.

Successful exploitation allows unauthenticated attackers to access the Werkzeug debugger interface, leading to disclosure of sensitive information and potential remote code execution on the affected system. This poses a critical risk to confidentiality and integrity of the application and underlying host.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running unfurl versions through 2025.08 in production environments or disable Flask debug mode manually by ensuring the debug configuration value is set to a boolean false or omitted. Monitor vendor channels for an official fix or update.