Skip to content
OpenAdvisories

Vendor

transmute-app

1 known vulnerabilities.

Products

transmute 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-54054

    Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects

    Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/url`, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint …

    transmute-app transmute