CVE-2026-26337

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26337
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26337.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26337
Published
2026-02-19T17:01:25.527Z
Modified
2026-07-16T03:31:06.834117300Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF
Details

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.

Database specific 
{
    "cwe_ids": [
        "CWE-36"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26337.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4.3.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/alfresco/alfresco-transform-core

Affected ranges

Type
GIT
Repo
https://github.com/alfresco/alfresco-transform-core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fb9353994535c452e0a8c0879036c3538f2d70cd
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.3.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*
2.1.0-RC1
2.1.1
2.2.0
2.2.0-A1
2.2.0-A2
2.2.0-A3
2.2.0-A4
2.2.0-A5
2.2.0-TEST1
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.10
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.4.0
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.5-A1
2.5.5-A2
2.5.5-A3
2.5.6
2.5.7
2.5.7-A1
2.5.7-A10
2.5.7-A11
2.5.7-A2
2.5.7-A3
2.5.7-A4
2.5.7-A5
2.5.7-A6
2.5.7-A7
2.5.7-A8
2.5.7-A9
2.5.8-A1
2.6.0
2.6.0-A1
2.6.0-A2
2.6.0-A3
2.7.0-A1
3.*
3.0.0
3.0.0-A1
3.0.0-A2
3.0.0-A3
3.0.0-A4
3.0.0-A5
3.0.0-A6
3.0.1-A1
3.0.1-A2
3.0.1-A3
3.0.1-A4
3.1.0
3.1.0-A1
3.1.0-A10
3.1.0-A11
3.1.0-A12
3.1.0-A2
3.1.0-A3
3.1.0-A4
3.1.0-A5
3.1.0-A6
3.1.0-A7
3.1.0-A8
3.1.0-A9
3.2.0-A1
3.2.0-A2
4.*
4.0.0
4.0.0-A1
4.0.1-A1
4.0.1-A2
4.0.1-A3
4.1.0-A1
4.1.0-M1
5.*
5.0.0
5.0.0-A1
5.0.0-A2
5.0.0-A3
5.0.0-A4
5.0.0-A5
5.0.1
5.0.1-A1
5.0.2-A1
5.0.2-A2
5.0.2-A3
5.0.2-A4
5.0.2-A5
5.1.0
5.1.0-A1
5.1.1
5.1.1-A1
5.1.1-A2
5.1.2
5.1.2-A1
5.1.3
5.1.3-A1
5.1.3-A2
5.1.3-A3
5.1.4
5.1.4-A1
5.1.4-A2
5.1.4-A3
5.1.5
5.1.5-A1
5.1.5-A2
5.1.5-A3
5.1.6
5.1.6-A.1
5.1.7
5.1.7-A.1
5.1.7-A.2
5.1.7-A.3
5.1.7-A.4
5.1.8-A.1
5.1.8-A.2
5.1.8-A.3
5.1.8-A.4
5.2.0
5.2.0-A.1
5.2.0-A.2
5.2.0-A.3
5.2.1
5.2.1-A.1
5.2.1-A.2
5.2.1-A.3
5.2.2
5.2.2-A.1
5.2.2-A.2
5.2.2-A.3
5.2.2-A.4
5.2.3
5.2.3-A.1
5.2.3-A.2
5.2.3-A.3
5.2.4
5.2.5
5.2.5-A.1
5.3.0-A.1
alfresco-docker-transformers-0.*
alfresco-docker-transformers-0.1
alfresco-docker-transformers-0.10
alfresco-docker-transformers-0.2
alfresco-docker-transformers-0.3
alfresco-docker-transformers-0.8
alfresco-docker-transformers-0.9
alfresco-docker-transformers-1.*
alfresco-docker-transformers-1.0
alfresco-docker-transformers-1.1
alfresco-docker-transformers-1.2
alfresco-docker-transformers-1.3
alfresco-docker-transformers-2.*
alfresco-docker-transformers-2.0.0-EA
alfresco-docker-transformers-2.0.0-RC1
alfresco-docker-transformers-2.0.0-RC2
alfresco-docker-transformers-2.0.1-EA
alfresco-docker-transformers-2.0.10
alfresco-docker-transformers-2.0.12
alfresco-docker-transformers-2.0.14
alfresco-docker-transformers-2.0.15
alfresco-docker-transformers-2.0.15-RC1
alfresco-docker-transformers-2.0.15-RC2
alfresco-docker-transformers-2.0.16
alfresco-docker-transformers-2.0.17
alfresco-docker-transformers-2.0.17-RC1
alfresco-docker-transformers-2.0.18
alfresco-docker-transformers-2.0.2-EA
alfresco-docker-transformers-2.0.3-EA
alfresco-docker-transformers-2.0.4-EA
alfresco-docker-transformers-2.0.4.1
alfresco-docker-transformers-2.0.4.2
alfresco-docker-transformers-2.0.4.3
alfresco-docker-transformers-2.0.5-RC
alfresco-docker-transformers-2.0.6-RC
alfresco-docker-transformers-2.0.7
alfresco-docker-transformers-2.0.8
alfresco-docker-transformers-2.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26337.json"