Executive brief
Transmute is an open-source file conversion and compression tool that allows users to import files from URLs. Prior to version 1.3.0, the URL import feature did not properly validate that downloaded content came from public, external sources, allowing authenticated users to access internal network resources, cloud metadata endpoints, or other services normally isolated from the internet. An attacker could exploit this to steal sensitive data or gain unauthorized access to internal systems running on the same network as the Transmute server.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/files/url endpoint (CWE-918). The vulnerable component is the HttpDownloader, which fetches user-supplied URLs with automatic redirect handling enabled but without validating whether the resolved destination is a public, external address. An authenticated user (or guest user if enabled) can craft a malicious URL pointing to internal services, loopback addresses, private IP ranges, or cloud metadata endpoints; the server will fetch the resource and store the response, allowing full-read SSRF attacks rather than blind SSRF. The vulnerability persists even when URLs redirect to internal addresses because each redirect is not validated. This is fixed in version 1.3.0 by adding destination validation to reject non-public address ranges and disabling automatic redirects in favor of manual validation of each redirect target.
Affected products
- transmute-app Transmute prior to 1.3.0
Timeline
- 2026-06-02: disclosed: GitHub security advisory GHSA-89m5-mvmx-7xrf published
- 2026-06-02: patched: Fixed in version 1.3.0