Hyland Alfresco Transformation Service enables an unauthenticated attacker to perform server‑side request forgery through its document processing functionality. By manipulating the request, the attacker can instruct the service to fetch arbitrary URLs, potentially accessing sensitive internal resources, external services, or performing reconnaissance on the internal network. This flaw enables the attacker to breach confidentiality, disrupt services, or further pivot within the environment.

The vulnerability afflicts Hyland Alfresco Community (Transform Core) and Hyland Alfresco Transformation Service (Enterprise). No specific version is enumerated; the flaw applies to all released instances of the affected components.

The CVSS score of 6.9 indicates a moderate to high severity, yet the Exploit Prediction Scoring System rate is below 1%, implying a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote network‑based, leveraging unauthenticated HTTP endpoints for triggering SSRF. Without immediate remediation, the flaw presents a tangible risk of internal data leakage and potential service disruption.