CVE-2026-69078

*** Pendiente de traducción *** CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality.<br /> <br /> User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML.<br /> <br /> An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges.<br /> <br /> Successful exploitation could allow an attacker to:<br /> <br /> * access services available only from the CTI-Transmute server or its internal network;<br /> * probe internal hosts and service endpoints;<br /> * retrieve local files readable by the application process; and<br /> * expose fetched content through the generated PDF, depending on the referenced resource type and rendering context.<br /> <br /> <br /> The vulnerability is corrected by providing WeasyPrint with a restrictive URL fetcher that permits only self-contained data: URIs. The externally hosted Google Fonts stylesheet was also removed so that PDF generation performs no intentional network or filesystem fetches.