Transmute
Monthly
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. Vendor-released patch is version 1.3.0; no public exploit identified at time of analysis.
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. Vendor-released patch is version 1.3.0; no public exploit identified at time of analysis.