EUVD-2026-52254
GHSA-7gc9-2qrw-frvj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Content submission to evaluation reports almost certainly requires authenticated access, warranting PR:L; scope changes to C because the server acts as an unrestricted proxy fetching resources on behalf of the attacker.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality.
User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML.
An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges.
Successful exploitation could allow an attacker to:
- access services available only from the CTI-Transmute server or its internal network;
- probe internal hosts and service endpoints;
- retrieve local files readable by the application process; and
- expose fetched content through the generated PDF, depending on the referenced resource type and rendering context.
The vulnerability is corrected by providing WeasyPrint with a restrictive URL fetcher that permits only self-contained data: URIs. The externally hosted Google Fonts stylesheet was also removed so that PDF generation performs no intentional network or filesystem fetches.
AnalysisAI
Server-side request forgery in CTI-Transmute's evaluation report PDF-generation pipeline allows an attacker who can inject content into a CTI evaluation report to coerce the application server into fetching arbitrary internal or filesystem resources. The vulnerability arises because user-controlled fields - conversion names, descriptions, and comments - flow through a Markdown-to-HTML conversion and are then rendered to PDF by WeasyPrint with its default unrestricted URL-fetching behavior intact, meaning crafted file:// or http(s):// references embedded in that content are fetched by the server process at render time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control one or more of the following user-supplied fields in CTI-Transmute: conversion name, conversion description, or comment text that is included in an evaluation report. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.0 score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N) reflects a network-accessible, low-complexity flaw with no privileges required and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to submit CTI content - such as a conversion description or comment field - crafts a Markdown snippet containing an embedded image or resource reference pointing to an internal endpoint, for example referencing the cloud metadata service at http://169.254.169.254/latest/meta-data/ or a local credentials file via file:///etc/passwd. When a legitimate user or scheduled job triggers PDF report generation, the WeasyPrint renderer fetches the injected URL using the application server's network identity and filesystem privileges, potentially embedding the retrieved content in the output PDF where it can be exfiltrated by the attacker. … |
| Remediation | The primary fix is to update CTI-Transmute to a revision at or after commit 20f35307bcb706c8dd8ca3884a88fb36b05b5244 (https://github.com/MISP/cti-transmute/commit/20f35307bcb706c8dd8ca3884a88fb36b05b5244). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all CTI-Transmute instances in production and document users with report creation privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cti Transmute
View allCross-site request forgery in CTI-Transmute's administrative user deletion endpoint enables unauthenticated remote attac
Uncontrolled resource consumption in CTI-Transmute's unauthenticated /activity_timeline endpoint allows remote attackers
Unauthorized disclosure of deleted-conversion history data in MISP cti-transmute (≤ 1.4.0) stems from a logic inversion
Stored XSS in MISP CTI Transmute's notification bell dropdown allows an attacker who can control convert names to inject
Missing authorization in MISP cti-transmute (versions ≤ 1.4.0) allows any authenticated user to add or remove emoji reac
Private evaluation comment disclosure in MISP's cti-transmute (all versions ≤ 1.4.0) allows any authenticated user with
Cross-site request forgery in MISP cti-transmute exposes four authenticated account endpoints - /account/follow, /accoun
Email address disclosure in MISP cti-transmute versions up to and including 1.4.0 exposes private user email addresses t
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScrip
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX obj
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared grap
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inj
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today