PT-2026-20876 · Hyland · Alfresco Transformation Service

Chudypb + 1 · Publicado 2026-02-19 · Atualizado 2026-03-02 · CVE-2026-26337

Positive Technologies (AI Summary)

CVSS v4.0

8.8

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Hyland Alfresco Transformation Service (affected versions not specified)

Description The Hyland Alfresco Transformation Service is susceptible to exploitation allowing unauthenticated attackers to perform arbitrary file read and server-side request forgery (SSRF) through absolute path traversal. The vulnerability allows attackers to access files and potentially manipulate server-side requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-36

Identificadores relacionados

CVE-2026-26337

Produtos afetados

Alfresco Transformation Service

Referências · 14

• https://hyland.com/en/solutions/products/alfresco-platform · Nota
• https://t.me/cveNotify/153848 · Publicação no Telegram
• https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551 · Aviso do Fabricante, Correção
• https://t.me/CVEtracker/45163 · Publicação no Telegram
• https://t.me/cveNotify/153847 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-26337 · Aviso do Fabricante
• https://t.me/cveNotify/153846 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2025892045697466462 · Publicação no Twitter
• https://vulncheck.com/advisories/hyland-alfresco-transformation-service-absolute-path-traversal-arbitrary-file-read-and-ssrf · Nota
• https://t.me/cveNotify/153613 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26337 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2024612287013626235 · Publicação no Twitter
• https://twitter.com/CveTodo/status/2024554153922458038 · Publicação no Twitter
• https://t.me/cveNotify/153612 · Publicação no Telegram