CVE Explorer
CVE-2026-69078
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality.
User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML.
An attacker able to supply conten
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"cti-transmute","repo":"https://github.com/MISP/cti-transmute/","vendor":"misp","versions":[{"lessThanOrEqual":"1.4.0","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:8fdc361899ad594d53ae5854deb206eb0ffebf252e720f73587b9c224945dcab · sha256:a30b575cecf5023b… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.8,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW",…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:8fdc361899ad594d53ae5854deb206eb0ffebf252e720f73587b9c224945dcab · sha256:a30b575cecf5023b… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:8fdc361899ad594d53ae5854deb206eb0ffebf252e720f73587b9c224945dcab · sha256:a30b575cecf5023b… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"tags":["patch"],"url":"https://github.com/MISP/cti-transmute/commit/20f35307bcb706c8dd8ca3884a88fb36b05b5244"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:8fdc361899ad594d53ae5854deb206eb0ffebf252e720f73587b9c224945dcab · sha256:a30b575cecf5023b… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.