CVE-2026-69078: CTI-Transmute SSRF Vulnerability

CVE-2026-69078 Overview

CTI-Transmute contains a server-side request forgery (SSRF) vulnerability in its evaluation report PDF-generation functionality. The application converts user-controlled Cyber Threat Intelligence (CTI) content, including conversion names, descriptions, and comments, from Markdown to HTML before rendering it as a PDF with WeasyPrint. Before the patch, the renderer used WeasyPrint's default URL-fetching behavior without restricting protocols or destinations. An attacker who can supply content referenced in an evaluation report can inject resource references using http://, https://, or file:// schemes. The application server then fetches those resources with its own network connectivity and filesystem privileges. This weakness maps to [CWE-918].

Critical Impact
Attackers can force the CTI-Transmute server to access internal services, probe internal networks, and read local files accessible to the application process, with fetched content potentially embedded in the generated PDF.

Affected Products

CTI-Transmute (MISP project) versions prior to the fix in commit 20f35307bcb706c8dd8ca3884a88fb36b05b5244
Deployments using WeasyPrint's default URL fetcher for PDF generation
The website/web/evaluate/evaluate_core.py PDF rendering component

Discovery Timeline

2026-08-03 - CVE-2026-69078 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-69078

Vulnerability Analysis

CTI-Transmute renders evaluation reports as PDFs using WeasyPrint. WeasyPrint follows external references embedded in HTML, such as <img>, <link>, and stylesheet imports. When the application accepted user-supplied Markdown for conversion names, descriptions, and comments, it converted that content to HTML and passed the result to WeasyPrint without a restrictive URL fetcher.

An attacker with permission to author CTI content can embed references that WeasyPrint dereferences during rendering. Requests originate from the application server, bypassing perimeter controls and reaching resources that external clients cannot access.

Root Cause

The root cause is unrestricted URL fetching in the PDF renderer. WeasyPrint's default fetcher resolves any URI scheme it supports, including http://, https://, and file://. The application did not validate, filter, or block schemes before rendering. An externally hosted Google Fonts stylesheet compounded the issue by normalizing outbound network activity from the renderer.

Attack Vector

Exploitation requires the attacker to place crafted content into a field that appears in an evaluation report, such as a conversion name, description, or comment. When a report is generated, WeasyPrint fetches the injected resources. Successful exploitation allows an attacker to:

reach services available only from the CTI-Transmute host or its internal network;
enumerate internal hosts and service endpoints;
retrieve local files readable by the application process; and
exfiltrate fetched content through the rendered PDF, depending on the referenced resource type and rendering context.

python

 import datetime
 from collections import Counter
 
+from weasyprint import HTML as WP_HTML, URLFetcher
+
 from website.db_class.db import Comment, Conversion, ConversionEvaluation, Tag
 from website.lib.misp import overall_level as _overall_level
 from website.lib.misp import parse_eval_tag as _parse_eval_tag

Source: GitHub commit 20f35307 — the patch introduces a restrictive URLFetcher that only permits self-contained data: URIs.

Detection Methods for CVE-2026-69078

Indicators of Compromise

Outbound HTTP or HTTPS requests originating from the CTI-Transmute application server to unexpected internal IP ranges or metadata endpoints such as 169.254.169.254.
Access log or audit entries showing file reads from unusual local paths by the application process during PDF generation.
Evaluation report content containing embedded references with file://, http://, or https:// schemes in conversion names, descriptions, or comments.

Detection Strategies

Inspect stored CTI content for URI schemes in fields that feed the evaluation report. Flag any file:// reference and any HTTP reference pointing to RFC 1918 addresses.
Correlate PDF-generation events with egress network activity from the application server to detect fetches triggered by report rendering.
Review WeasyPrint log output for successful fetches of resources other than embedded data: URIs.

Monitoring Recommendations

Enable egress traffic logging on the CTI-Transmute host and alert on connections to internal-only subnets, cloud metadata services, and localhost ports.
Monitor filesystem access by the application service account, particularly reads of /etc/, /proc/, and user home directories.
Ingest application and reverse proxy logs into a centralized SIEM to correlate report-generation activity with anomalous outbound requests.

How to Mitigate CVE-2026-69078

Immediate Actions Required

Upgrade CTI-Transmute to a build that includes commit 20f35307bcb706c8dd8ca3884a88fb36b05b5244 or later.
Restrict who can author or edit conversion names, descriptions, comments, and any other fields rendered in evaluation reports.
Place the application server behind an egress filter that denies traffic to internal ranges and cloud metadata endpoints.

Patch Information

The fix supplies WeasyPrint with a restrictive URLFetcher that permits only self-contained data: URIs and removes the externally hosted Google Fonts stylesheet, so PDF generation performs no intentional network or filesystem fetches. Apply the change published in the MISP CTI-Transmute security commit.

Workarounds

If patching is not immediately possible, disable evaluation report PDF generation until the fix is deployed.
Run the CTI-Transmute service under a low-privilege account with no read access to sensitive files or credentials on the host.
Block outbound traffic from the application server at the network layer, allowing only destinations required for normal operation.

bash

# Example egress restriction using iptables to block internal ranges
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner cti-transmute -d 169.254.169.254 -j REJECT