CVE WatchJul 14, 2026

CVE-2026-26337

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery

CVSS

8.2

High

EPSS

0.4%

p28

KEV

—

Exploit Today

0-100

Published: Feb 19, 2026 · Last modified: Jul 14, 2026 · CWE-36

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-06-302026-07-17

Technical description

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-153025.3 MED

41.4%

——12The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.4d CVE-2026-08467.5 HIG

34.7%

——10A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input paths. The function directly opens files specified by user input without sanitization, enabling attackers to access sensitive system files by providing absolute paths or traversal paths. This vulnerability can be exploited locally or remotely, particularly in scenarios where the function is used in web APIs or other interfaces that accept user-supplied input.3d CVE-2026-572116.5 MED

32.7%

——10RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.4d CVE-2026-583006.2 MED

25.9%

——8Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.10d