CVE-2026-54054 Details

A Server-Side Request Forgery (SSRF) vulnerability has been identified in Transmute, a self-hosted file conversion and compression tool, prior to version 1.3.0. The issue resides in the URL import endpoint, 'POST /api/files/url', which allows authenticated users, or guest users if enabled, to manipulate the Transmute server into making HTTP requests to internal or cloud-local resources. This vulnerability arises because the HTTP downloader for this endpoint fetches user-supplied URLs with redirects enabled, without validating whether the target URL resolves to a public, external address. Consequently, downloaded content, which is stored and can be accessed later through 'GET /api/files/{id}', allows for full-read SSRF exploitation rather than blind SSRF.

Users are advised to update Transmute to version 1.3.0 or later, where this vulnerability has been fixed. The patch includes URL destination validation to ensure that only public addresses are contacted, disables automatic redirects, and requires manual validation of each redirect target before following it.