transmute vulnerabilities

CVEs whose affected-version data names the transmute package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-54054Medium· 6.5

1w ago

Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/url`, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader …

▾ Sunlittransmute-app · transmuteEPSS 0.26%via CVEORG