CVE-2026-26337

HighCVSS 8.2/10Last modified Jul 14, 2026

Description

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-36

Affected software

VendorProductVersions
HylandAlfresco Transformation Service (Enterprise)< 4.3.0
HylandAlfresco Community (Transform Core)< 5.3.0

References

Timeline

Published
Feb 19, 2026
Last modified
Jul 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-263389.8Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document pCVE-2026-263399.8Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnCVE-2026-26349.8Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowiCVE-2026-263407.5Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A CVE-2026-263419.8Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that are not forced to be CVE-2026-263429.8Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X-User-Token) with inCVE-2026-263455.4SPIP before 4.4.8 contains a stored cross-site scripting (XSS) vulnerability in the public area triggered in certain edge-case usage patternCVE-2026-26357.3MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on aCVE-2026-263514.8GetSimpleCMS Community Edition (CE) versions prior to 3.3.22 (3.3.16 tested) contains a stored cross-site scripting (XSS) vulnerability in tCVE-2026-263525.4Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script duCVE-2026-263549.8Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version CVE-2026-263556.5Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1
CVE-2026-26337: High severity, CVSS 8.2 | Vulnix