CVE-2026-69078 is a server-side request forgery vulnerability in CTI-Transmute's evaluation report PDF-generation feature. User-supplied CTI content is converted from Markdown to HTML and rendered via WeasyPrint, which before patching used default URL-fetching behavior without protocol or destination restrictions. This allowed attackers to inject crafted resource references (http, https, file schemes) that the server would fetch using its network and filesystem privileges. Exploitation could lead to accessing internal services, probing internal hosts, reading local files accessible to the application, and exposing fetched content in the generated PDF. The vulnerability is remediated by configuring WeasyPrint to only allow self-contained data URIs and removing external network fetches such as Google Fonts.

Successful exploitation allows an unauthenticated attacker who can supply content to evaluation reports to cause the CTI-Transmute server to make arbitrary network requests or read local files. This can lead to unauthorized access to internal network services, reconnaissance of internal hosts, disclosure of local files readable by the application, and potential exposure of fetched content via the PDF output. The CVSS 4.0 score is 8.8 (high severity), reflecting network attack vector, no privileges or user interaction required, and high impact on confidentiality.

A fix is available that restricts WeasyPrint's URL fetching to only self-contained data URIs and removes external resource dependencies such as Google Fonts. Users should upgrade to a version later than 1.4.0 where this patch is applied. Since no official patch link or advisory is provided in the input, verify the vendor's advisory for the exact fixed version and update accordingly. Until patched, avoid generating evaluation report PDFs from untrusted content.