Server-Side Request Forgery in CTI-Transmute by MISP

CVE-2026-69078

What is CVE-2026-69078?

CTI-Transmute is susceptible to a server-side request forgery (SSRF) vulnerability in its PDF-generation functionality that leverages user-controlled content. This vulnerability allows users to inject crafted resource references through input fields like conversion names and descriptions, which are then converted from Markdown to HTML and rendered into a PDF. The application server's unrestricted URL-fetching behavior could lead to unauthorized access to internal services and sensitive files. Successful exploitation permits attackers to probe internal networks, retrieve local files, and expose this data within the generated PDF. A recent patch has mitigated the issue by implementing a restrictive URL fetcher and removing external dependencies, ensuring the application performs no unintended network or filesystem operations.

References