EUVD-2026-75805Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Low-privileged account required; full-read SSRF enables C:H via cloud IMDS access; no integrity or availability impact observed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public, external address. As a result, an authenticated user (or guest user if they are enabled) may be able to cause the Transmute server to make HTTP requests to internal or cloud-local resources from the server's network position. Because downloaded content is stored and can later be retrieved through GET /api/files/{id}, this issue can result in full-read SSRF rather than blind SSRF. This is fixed in version 1.3.0.
AnalysisAI
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Transmute account with access to the URL import feature (`POST /api/files/url`), OR guest user access if that feature has been enabled in the Transmute configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the attack profile: network-reachable, low complexity, requires at least a low-privileged Transmute account, with high confidentiality impact and no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Transmute version 1.3.0, which adds SSRF prevention to URL-based downloads (commit be1698c, co-authored by the responsible reporter tonghuaroot). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today