Technical impact
CTI-Transmute’s PDF rendering engine translates user‑supplied Markdown content into HTML and then into a PDF using WeasyPrint. Because the renderer was configured to use WeasyPrint’s default URL‑fetching behavior, it would automatically follow any resource references included in the generated HTML. A user who can submit an evaluation report could therefore inject arbitrary URLs—including http, https, and file schemes—causing the server to fetch those resources with the application’s network and filesystem privileges. This flaw can lead to the disclosure of internal services, probing of the internal network, reading of local files accessible to the application, and inclusion of external content in the produced PDF, which collectively represent a significant confidentiality and integrity compromise.
Affected Systems
The affected product is CTI-Transmute, an open‑source content transformation tool maintained by the MISP community. All releases prior to the corrective commit are vulnerable; no specific version numbers are listed in the advisory. The vulnerability exists in the component that generates evaluation PDF reports.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity. Although an EPSS value is not available, the lack of a currently listed KEV entry suggests no known mass exploitation yet; however, the ability to reach internal resources makes this a serious risk for environments where the application exposes the PDF generation endpoint. The likely attack vector is through the user‑controlled content of an evaluation report, which an attacker can supply when generating a PDF. If the application is exposed to external users, remote exploitation is possible; if only internal users can generate PDFs, the threat is internal but still significant.
