CVE-2026-54054: Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects

Published Sep 10, 2026
·
Updated

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, POST /api/files/url, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public, external address. As a result, an authenticated user (or guest user if they are enabled) may be able to cause the Transmute server to make HTTP requests to internal or cloud-local resources from the server's network position. Because downloaded content is stored and can later be retrieved through GET /api/files/{id}, this issue can result in full-read SSRF rather than blind SSRF. This is fixed in version 1.3.0.

Affected Software

1 affected component
Transmute<1.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Transmute to a version that resolves this vulnerability.

    Fixed in 1.3.0

Event History

Sep 10, 2026
CVE Published
via MITRE·09:52 PM
Data Sourced
via MITRE·09:52 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

Any authenticated user can submit a URL to the import endpoint. Guest users can also exploit it if guest access is enabled.

2

What access can an attacker gain through the SSRF?

The server can be induced to make HTTP requests to internal or cloud-local resources reachable from its network position. Retrieved content is stored and later available through GET /api/files/{id}, allowing the attacker to read the fetched response rather than only detecting whether a request succeeded.

3

Do redirects affect exploitability?

Yes. The downloader follows redirects, so an attacker can supply a URL that redirects to an internal or cloud-local target. The affected downloader does not validate whether the destination resolves to a public external address.

4

Which versions are affected and what fixes the issue?

Transmute versions prior to 1.3.0 are affected. Version 1.3.0 fixes the issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203