Alfresco Transform Service CVE-2026-26337

Exploitation requires network reachability to the Alfresco Transformation Service / Transform Core transform endpoint and the ability to submit a transformation request containing an absolute path or URI as the source input - the absolute-path-traversal handling of that source parameter is the exact condition. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed against a reachable instance. The primary limiting factor is exposure: the impact is bounded by whether the transform component is network-accessible to the attacker (it is often intended to be internal-only behind the Alfresco repository), and the SSRF value depends on what internal hosts the transform server can reach. Confidentiality impact is High (arbitrary file read) while integrity is only Low and availability unaffected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and limited integrity impact - a genuine priority for any internet- or broadly-network-exposed transform endpoint. However, signals are mixed: the EPSS score is low (0.12%, 31st percentile), there is no CISA KEV listing and no public POC identified, indicating no evidence of active or widespread exploitation yet. The high CVSS is driven by the unauthenticated confidentiality impact (arbitrary file read), while the SSRF component's real-world severity depends heavily on internal network reachability from the transform host. No SSVC decision data was provided. Note a caveat: the CVSS scores confidentiality as High but integrity only Low and availability None, which is consistent with read/SSRF rather than full compromise - do not over-rate this as RCE. Overall this is a legitimate, patch-soon issue for exposed deployments, but the low EPSS and absence of KEV/POC suggest it is not yet under active mass exploitation.

An unauthenticated attacker who can reach the Transform Service endpoint submits a transformation request supplying an absolute path (e.g., a local file path or an internal URL) as the source. The service reads and returns the referenced local file, disclosing sensitive files such as configuration or credential material, or is coerced into issuing an outbound request to an attacker-chosen internal host for SSRF. No public POC has been identified, but the low complexity and lack of authentication (AC:L/PR:N/UI:N) make exploitation straightforward for anyone with network access to the endpoint.