TI-2025-40881 CVE-2025-66449
ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution
Priority HIGH 73
ConvertXis a self-hosted online file converter.
C4illin
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
C4illin records in CISA KEVNo C4illin vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records
Priority HIGH 70
ConvertX is a self-hosted file conversion service.
TI-2026-19946 CVE-2026-24741
ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`
Priority HIGH 68
ConvertXis a self-hosted online file converter.
TI-2026-67393 CVE-2026-105080 · GHSA-6w7x-66x4-9w6v
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead…
Priority MEDIUM 43
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre.
Priority LOW 34
ConvertX is a self-hosted file conversion service.
TI-2026-58743 CVE-2026-85618 · GHSA-g238-2mw5-49xx
ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
Priority LOW 32
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives.
TI-2026-70674 CVE-2026-108694 · GHSA-r4xg-82px-pwx6
Arbitrary file read in ConvertX via Pandoc converter
Priority LOW 31
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag.