CTI-Transmute CVE-2026-69078

Exploitation requires that the attacker control one or more of the following user-supplied fields in CTI-Transmute: conversion name, conversion description, or comment text that is included in an evaluation report. The attacker must be able to trigger or wait for PDF generation of a report containing their injected content - either by generating the report themselves or by influencing a privileged user to do so. The CVSS 4.0 vector assigns PR:N, suggesting the content-submission path may be accessible without prior authentication in some deployment configurations, but exploitation in environments where all content submission requires authenticated sessions limits the attacker population to credentialed users or compromised accounts. Exploitation is further bounded by the application server's egress network policy and the filesystem paths readable by the process user; environments with strict egress filtering or tight filesystem permissions will see reduced impact even if the SSRF trigger is reached.

The official CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) reflects a network-accessible, low-complexity flaw with no privileges required and high confidentiality impact. The PR:N assignment warrants scrutiny: exploitation requires an attacker to supply content that is included in an evaluation report, which in practice typically implies some level of platform access or authenticated session, though external CTI feed integration or guest-submission scenarios could reduce this bar. The VC:H rating is well-founded given the ability to read arbitrary local files via file:// schemes and exfiltrate internal service responses embedded in the generated PDF. No CISA KEV listing and no public POC reduce immediate threat urgency, but the SSRF impact class - internal network probing plus local file disclosure - is highly attractive to post-authentication lateral movement actors. The wildcard CPE version range confirms all prior releases are affected, with remediation only available as a source-level commit rather than a tagged release, leaving self-hosted deployments at risk until administrators apply the patch manually.

An attacker with access to submit CTI content - such as a conversion description or comment field - crafts a Markdown snippet containing an embedded image or resource reference pointing to an internal endpoint, for example referencing the cloud metadata service at http://169.254.169.254/latest/meta-data/ or a local credentials file via file:///etc/passwd. When a legitimate user or scheduled job triggers PDF report generation, the WeasyPrint renderer fetches the injected URL using the application server's network identity and filesystem privileges, potentially embedding the retrieved content in the output PDF where it can be exfiltrated by the attacker. No public POC exists at time of analysis, but the technique is well-documented for WeasyPrint-backed PDF generators.