CVE-2026-54054

Received Received - Intake

Server-Side Request Forgery in Transmute File Conversion Tool

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/url`, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public, external address. As a result, an authenticated user (or guest user if they are enabled) may be able to cause the Transmute server to make HTTP requests to internal or cloud-local resources from the server's network position. Because downloaded content is stored and can later be retrieved through `GET /api/files/{id}`, this issue can result in full-read SSRF rather than blind SSRF. This is fixed in version 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-54054

Affected Vendors & Products

Vendor	Product	Version / Range
transmute	transmute	to 1.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in Transmute, a file conversion tool. The issue is in the URL import endpoint which fetches user-supplied URLs without validating if they resolve to internal or external addresses. This allows authenticated users (or guests if enabled) to trick the server into making HTTP requests to internal resources.

Detection Guidance

To detect this SSRF vulnerability in Transmute, check the version of your installation. If it is below 1.3.0, the system is vulnerable. Inspect network logs for outbound HTTP requests originating from the Transmute server to internal or unexpected external addresses.

Impact Analysis

An attacker could exploit this to access internal network resources, potentially stealing sensitive data or performing unauthorized actions. Since downloaded content is stored and retrievable, the impact includes full-read SSRF, allowing unauthorized access to internal systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Transmute to version 1.3.0 or later immediately. If upgrading is not possible, disable the URL import endpoint or restrict access to authenticated users only. Monitor network traffic for suspicious outbound requests.

Hi! I’m here to help you understand CVE-2026-54054. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70