CVE-2026-69078
Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
Description
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML. An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges. Successful exploitation could allow an attacker to: * access services available only from the CTI-Transmute server or its internal network; * probe internal hosts and service endpoints; * retrieve local files readable by the application process; and * expose fetched content through the generated PDF, depending on the referenced resource type and rendering context. The vulnerability is corrected by providing WeasyPrint with a restrictive URL fetcher that permits only self-contained data: URIs. The externally hosted Google Fonts stylesheet was also removed so that PDF generation performs no intentional network or filesystem fetches.
INFO
Published Date :
Aug. 3, 2026, 10:16 a.m.
Last Modified :
Oct. 23, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
5a6e4751-2f3f-4070-9419-94fb35b644e8
Affected Products
The following products are affected by CVE-2026-69078
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 | ||||
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Solution
- Apply the security patch for CTI-Transmute.
- Configure WeasyPrint with a restrictive URL fetcher.
- Remove external Google Fonts stylesheet.
- Ensure no intentional network fetches during PDF generation.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-69078.
| URL | Resource |
|---|---|
| https://github.com/MISP/cti-transmute/commit/20f35307bcb706c8dd8ca3884a88fb36b05b5244 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-69078 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-69078
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-69078 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-69078 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: cti-transmute de misp, Description: CTI-Transmute se ve afectado por una vulnerabilidad de falsificación de petición del lado del servidor en la funcionalidad de generación de PDF de informes de evaluación. El contenido CTI controlado por el usuario, incluyendo nombres de conversión, descripciones y comentarios, se convierte de Markdown a HTML y se renderiza como un PDF usando WeasyPrint. Antes del parche, el renderizador utilizaba el comportamiento predeterminado de WeasyPrint para la obtención de URL sin restringir los protocolos o destinos que podían ser referenciados por el HTML generado. Un atacante capaz de proporcionar contenido incluido en un informe de evaluación podría inyectar referencias de recursos manipuladas utilizando esquemas como http://, https://, o file: //. Cuando se renderizaba el informe, CTI-Transmute podría obtener estos recursos utilizando la conectividad de red del servidor de aplicaciones y los privilegios del sistema de archivos. La explotación exitosa podría permitir a un atacante: * acceder a servicios disponibles solo desde el servidor CTI-Transmute o su red interna; * sondear hosts internos y puntos finales de servicio; * recuperar archivos locales legibles por el proceso de la aplicación; y * exponer el contenido obtenido a través del PDF generado, dependiendo del tipo de recurso referenciado y el contexto de renderizado. La vulnerabilidad se corrige proporcionando a WeasyPrint un recuperador de URL restrictivo que permite solo URIs de datos autocontenidos. La hoja de estilo de Google Fonts alojada externamente también fue eliminada para que la generación de PDF no realice recuperaciones intencionales de red o sistema de archivos. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 03, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-69078', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-03T10:55:56.325226Z'} -
New CVE Received by 5a6e4751-2f3f-4070-9419-94fb35b644e8
Aug. 03, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/MISP/cti-transmute/', 'vendor': 'misp', 'product': 'cti-transmute', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '1.4.0'}], 'defaultStatus': 'unaffected'}] Added Description CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML. An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges. Successful exploitation could allow an attacker to: * access services available only from the CTI-Transmute server or its internal network; * probe internal hosts and service endpoints; * retrieve local files readable by the application process; and * expose fetched content through the generated PDF, depending on the referenced resource type and rendering context. The vulnerability is corrected by providing WeasyPrint with a restrictive URL fetcher that permits only self-contained data: URIs. The externally hosted Google Fonts stylesheet was also removed so that PDF generation performs no intentional network or filesystem fetches. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-918 Added Reference https://github.com/MISP/cti-transmute/commit/20f35307bcb706c8dd8ca3884a88fb36b05b5244