CVE-2026-69078

Name of the Vulnerable Software and Affected Versions CTI-Transmute (affected versions not specified)

Description A server-side request forgery issue exists in the evaluation report PDF-generation functionality. User-controlled CTI content, such as conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. The renderer used default URL-fetching behavior without restricting protocols or destinations. An attacker can inject crafted resource references using schemes like http://, https://, or file://, allowing the application server to fetch resources using its network connectivity and filesystem privileges. This could lead to accessing internal services, probing internal hosts, retrieving local files readable by the application process, or exposing fetched content within the generated PDF.

Recommendations Update the software to the patched version that implements a restrictive URL fetcher for WeasyPrint permitting only self-contained data: URIs and removes the externally hosted Google Fonts stylesheet.