CyberRota Analysis
AI-GeneratedTransmute versions prior to 1.3.0 are vulnerable to Server-Side Request Forgery (SSRF) due to inadequate validation of user-supplied URLs in its import endpoint, allowing authenticated users to make unauthorized HTTP requests to internal or cloud-local resources. This vulnerability can lead to the exposure of sensitive data stored on the server, as downloaded content can be accessed later. Organizations using Transmute for file conversion and compression should prioritize upgrading to version 1.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/url`, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public, external address. As a result, an authenticated user (or guest user if they are enabled) may be able to cause the Transmute server to make HTTP requests to internal or cloud-local resources from the server's network position. Because downloaded content is stored and can later be retrieved through `GET /api/files/{id}`, this issue can result in full-read SSRF rather than blind SSRF. This is fixed in version 1.3.0.