PT-2026-20876 · Hyland · Alfresco Transformation Service

Chudypb + 1 · Published 2026-02-19 · Updated 2026-03-02 · CVE-2026-26337

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Hyland Alfresco Transformation Service (affected versions not specified)

Description The Hyland Alfresco Transformation Service is susceptible to exploitation allowing unauthenticated attackers to perform arbitrary file read and server-side request forgery (SSRF) through absolute path traversal. The vulnerability allows attackers to access files and potentially manipulate server-side requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2026-26337

Affected Products

Alfresco Transformation Service

References · 14

• https://osv.dev/vulnerability/CVE-2026-26337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26337 · Security Note
• https://hyland.com/en/solutions/products/alfresco-platform · Note
• https://t.me/cveNotify/153848 · Telegram Post
• https://connect.hyland.com/t5/alfresco-blog/security-update-cve-2026-26337-cve-2026-26338-cve-2026-26339/ba-p/496551 · Vendor Advisory, Patch
• https://t.me/CVEtracker/45163 · Telegram Post
• https://t.me/cveNotify/153847 · Telegram Post
• https://t.me/cveNotify/153846 · Telegram Post
• https://twitter.com/CVEnew/status/2025892045697466462 · Twitter Post
• https://vulncheck.com/advisories/hyland-alfresco-transformation-service-absolute-path-traversal-arbitrary-file-read-and-ssrf · Note
• https://t.me/cveNotify/153613 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024612287013626235 · Twitter Post
• https://twitter.com/CveTodo/status/2024554153922458038 · Twitter Post
• https://t.me/cveNotify/153612 · Telegram Post