Medium 6.5Published Sep 10, 2026

CVE-2026-54054Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects transmute-app transmute. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for transmute-app transmute

Exploited in the last 30 days

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/url`, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public, external address. As a result, an authenticated user (or guest user if they are enabled) may be able to cause the Transmute server to make HTTP requests to internal or cloud-local resources from the server's network position. Because downloaded content is stored and can later be retrieved through `GET /api/files/{id}`, this issue can result in full-read SSRF rather than blind SSRF. This is fixed in version 1.3.0.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

transmute-app transmute transmute_app:transmute (from the name)	before 1.3.0	CNA record

References

https://github.com/transmute-app/transmute/security/advisories/GHSA-89m5-mvmx-7xrfx-refsource-confirm
https://github.com/transmute-app/transmute/releases/tag/v1.3.0x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.