CVE-2026-26337: Alfresco Transformation Service SSRF

CVE-2026-26337 Overview

CVE-2026-26337 is a critical path traversal vulnerability affecting the Hyland Alfresco Transformation Service. This flaw allows unauthenticated remote attackers to exploit absolute path traversal to achieve both arbitrary file read and server-side request forgery (SSRF) attacks. The vulnerability requires no authentication and can be exploited over the network, making it particularly dangerous for organizations using vulnerable versions of the Alfresco platform.

Critical Impact

Unauthenticated attackers can read arbitrary files from the server and perform SSRF attacks, potentially exposing sensitive configuration data, credentials, and enabling pivoting to internal services.

Affected Products

• Hyland Alfresco Transformation Service

Discovery Timeline

• 2026-02-19 - CVE-2026-26337 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26337

Vulnerability Analysis

This vulnerability is classified under CWE-36 (Absolute Path Traversal), which occurs when user-supplied input containing absolute path sequences is not properly sanitized before being used to access files on the server. In the context of the Alfresco Transformation Service, attackers can manipulate file path parameters to break out of intended directories and access arbitrary files on the underlying system.

The dual nature of this vulnerability—combining arbitrary file read with SSRF capabilities—significantly amplifies the potential impact. Attackers can not only exfiltrate sensitive files such as /etc/passwd, configuration files, or application secrets, but can also leverage the SSRF component to probe internal network services, access cloud metadata endpoints, or interact with services that trust the vulnerable server.

The network-accessible attack vector combined with no authentication requirements means this vulnerability can be exploited by any attacker who can reach the Alfresco Transformation Service endpoint.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the Alfresco Transformation Service. The service fails to properly sanitize user-controlled path inputs, allowing absolute path sequences to be interpreted directly by the file system. When processing transformation requests, the service does not adequately restrict the file paths that can be accessed, enabling attackers to traverse outside the intended directory structure using absolute paths.

Attack Vector

The attack vector is network-based, requiring no prior authentication or user interaction. An attacker can craft malicious HTTP requests to the Transformation Service endpoint with specially crafted absolute path parameters. These requests bypass normal access controls and allow direct file system access or trigger outbound requests to attacker-controlled or internal servers.

The exploitation mechanism involves:

1. Identifying an exposed Alfresco Transformation Service endpoint
2. Crafting requests containing absolute file paths to read sensitive files
3. Alternatively, abusing the SSRF capability to make the server initiate connections to arbitrary internal or external hosts

For detailed technical analysis and exploitation specifics, refer to the VulnCheck Advisory on Hyland Alfresco.

Detection Methods for CVE-2026-26337

Indicators of Compromise

• HTTP requests to the Alfresco Transformation Service containing absolute file paths such as /etc/passwd, /etc/shadow, or Windows system paths
• Requests containing path traversal patterns targeting configuration files or credential stores
• Unexpected outbound connections from the Transformation Service to internal or external hosts
• Access logs showing requests for sensitive system or application files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing absolute path sequences or known sensitive file paths
• Monitor application logs for unusual file access patterns or transformation requests targeting system files
• Configure intrusion detection systems (IDS) to alert on HTTP requests with path traversal indicators
• Review proxy and firewall logs for unexpected outbound connections originating from Alfresco services

Monitoring Recommendations

• Enable verbose logging on the Alfresco Transformation Service to capture all incoming request parameters
• Set up alerts for any access attempts to system-level files or directories outside the application's document root
• Monitor network traffic from Alfresco services for connections to unauthorized internal subnets or cloud metadata endpoints
• Regularly audit access logs for suspicious patterns indicative of exploitation attempts

How to Mitigate CVE-2026-26337

Immediate Actions Required

• Restrict network access to the Alfresco Transformation Service to trusted hosts only using firewall rules or network segmentation
• Implement input validation at the web application layer to reject requests containing absolute path sequences
• Place the Transformation Service behind a reverse proxy with strict URL filtering capabilities
• Audit existing deployments for signs of compromise before applying patches

Patch Information

Organizations should consult the Hyland Alfresco Product Overview page and official Hyland security communications for the latest patch information and updated versions that address this vulnerability. The VulnCheck Advisory provides additional details on affected versions and remediation guidance.

Workarounds

• Disable or restrict access to the Transformation Service if not critically needed until a patch can be applied
• Implement network-level controls to limit which hosts can communicate with the Transformation Service
• Deploy a web application firewall (WAF) with rules specifically targeting path traversal and SSRF patterns
• Configure the service to run with minimal file system permissions to limit the impact of arbitrary file read attacks