CTI-Transmute 1.5 fixes 16 flaws
MISP's CTI-Transmute conversion service patched 16 vulnerabilities in v1.5, including four unauthenticated high-severity bugs enabling SSRF, DoS, CSRF and local file disclosure.
Sourcemisp-project.org — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CIRCL's CTI-Transmute project, an open-source MISP/STIX conversion and catalogue service, released version 1.5 following an external security review by Jeroen Pinoy plus an internal audit. The release remediates 16 distinct vulnerabilities, each tracked with its own GCVE/CVE identifier and regression test. Four of the findings carry High severity (CVSS 8.7-8.8) and are all exploitable without authentication or via forged requests: an HTML-injection flaw in the PDF export that let attackers read local files and probe internal services via file:// and internal URLs reaching the PDF renderer; a CSRF issue where account deletion was triggered via a GET request; an unauthenticated SSRF in the remote-MISP fetch routes that only checked IP literals, allowing hostname-based bypass into internal networks; and an unbounded parameter on the activity timeline enabling trivial denial-of-service. The remaining twelve Medium and one Low finding cover stored XSS, missing authorization checks exposing private data, and additional state-changing GET routes.
Beyond individual patches, the release hardens the application architecture: a nonce-based CSP, neutralized Vue template expression execution, hardened session cookies, a sandboxed PDF renderer that no longer touches the filesystem or network, authentication requirements on remote-fetch routes, and conversion of GET-based mutating routes to POST/DELETE with CSRF tokens. The update also ships a first-class public API with X-API-KEY authentication, a schema-driven parameter system, a reworked graph view (Pivotick 1.5, also hardened), and expanded test coverage (0 to 516 tests) with CI enforcement.
This is a vendor security-fix advisory rather than a report of active exploitation; there is no evidence any of the flaws were exploited in the wild. However, given the unauthenticated, low-complexity nature of the four High-severity issues (SSRF, CSRF, file disclosure, DoS) and the tool's use within the threat-intel community, operators running earlier versions should upgrade promptly and follow the documented migration/breaking-change guidance (route method changes, session cookie defaults, CSP updates).
Mentioned in this report
Source reporting: https://www.misp-project.org/2026/08/11/cti-transmute-v1.5-released.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs