CVE-2026-26337 – CVE-2026-26337 is an absolute path traversal vu... (How to Fix)

Q: What is the severity of CVE-2026-26337?

CVE-2026-26337 has a CVSS score of 8.2 (HIGH). CVE-2026-26337 is an absolute path traversal vulnerability in Hyland Alfresco Transformation Service that allows unauthenticated attackers to read arbitrary files and perform server-side request forgery (SSRF). This affects organizations using vulnerable versions of Alfresco Transformation Service, potentially exposing sensitive data and internal systems.

📋 TL;DR

CVE-2026-26337 is an absolute path traversal vulnerability in Hyland Alfresco Transformation Service that allows unauthenticated attackers to read arbitrary files and perform server-side request forgery (SSRF). This affects organizations using vulnerable versions of Alfresco Transformation Service, potentially exposing sensitive data and internal systems.

💻 Affected Systems

Products:

Hyland Alfresco Transformation Service

Versions: Specific versions not detailed in references; likely multiple versions before patched release

Operating Systems: All platforms running Alfresco Transformation Service

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the transformation service component; requires the service to be running and accessible.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could read sensitive system files (passwords, configuration), access internal services via SSRF, and potentially pivot to other systems in the network.

🟠

Likely Case

Unauthenticated attackers reading application configuration files, accessing internal metadata, and performing limited SSRF against internal services.

🟢

If Mitigated

With proper network segmentation and access controls, impact is limited to the application server's file system and local network services.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Absolute path traversal vulnerabilities typically have low exploitation complexity; SSRF component may require additional steps.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not specified in references; check vendor advisory

Vendor Advisory: https://www.hyland.com/en/solutions/products/alfresco-platform

Restart Required: Yes

Instructions:

1. Check vendor advisory for patched version. 2. Backup current installation. 3. Apply vendor-provided patch or upgrade to fixed version. 4. Restart Alfresco Transformation Service. 5. Verify fix implementation.

🔧 Temporary Workarounds

Network Access Restriction

linux

Restrict network access to Alfresco Transformation Service to only trusted sources

iptables -A INPUT -p tcp --dport [ALFRESCO_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [ALFRESCO_PORT] -j DROP

Application Firewall Rules

all

Implement WAF rules to block path traversal patterns

ModSecurity: SecRule REQUEST_URI "@rx \.\.(/|%2f)" "id:1001,phase:1,deny,status:403"

🧯 If You Can't Patch

Implement strict network segmentation to isolate Alfresco Transformation Service from sensitive systems
Deploy web application firewall with path traversal and SSRF protection rules

🔍 How to Verify

Check if Vulnerable:

Test for path traversal by attempting to access files outside web root using ../ patterns in transformation requests

Check Version:

Check Alfresco Transformation Service version in administration console or configuration files

Verify Fix Applied:

Attempt same path traversal tests after patch; successful requests should return 403/404 errors instead of file contents

📡 Detection & Monitoring

Log Indicators:

Multiple failed attempts with ../ patterns in URLs
Unusual file access patterns from single IPs
Outbound requests to internal IPs from transformation service

Network Indicators:

Unusual traffic patterns to transformation service endpoints
Requests containing ../ patterns
Outbound connections from transformation service to internal systems

SIEM Query:

source="alfresco-transformation.log" AND (uri="*../*" OR uri="*..%2f*")

📊 Metadata

CVE ID: CVE-2026-26337

CVSS v3 Score: 8.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE: CWE-36

Published: February 19, 2026

Last Updated: March 2, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-26337, you might also want to check these: