ConvertX CVE-2025-66449

Requires an authenticated low-privilege account on a ConvertX instance running a version prior to 0.16.0 (PR:L); the attacker then abuses the /upload endpoint, which in vulnerable versions passes the user-supplied file.name directly into Bun.write(${userUploadsDir}${file.name}) with no sanitization, permitting path traversal and overwrite of files outside the uploads directory. No special non-default configuration is needed - this is default behavior of the vulnerable code path - and no user interaction is required. The primary limiting factor is the need for valid authentication; realistic risk is therefore highest on instances that allow open/self-service registration or expose the account to untrusted users, and lower on single-user or trusted-LAN deployments.

This is a credible, high-priority vulnerability for anyone running ConvertX below 0.16.0, though its real-world blast radius is constrained by the product's niche footprint. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with full compromise of confidentiality, integrity, and availability - consistent with the described arbitrary file write escalating to code execution by overwriting system binaries. Publicly available exploit code exists (referenced GHSA advisory and the fixing commit that adds sanitize-filename), which raises practical exploitability for anyone who can obtain a ConvertX account. However, there is NO EPSS score in the provided data and NO CISA KEV listing, so there is no evidence of active or widespread exploitation at time of analysis - the signal mix (patch + public PoC, but no KEV/EPSS) points to a serious-but-not-yet-mass-exploited issue. One caveat to verify: the PR:L rating assumes the instance enforces authentication, but ConvertX is a self-hosted converter that may be deployed without registration restrictions or exposed to untrusted users, in which case the authentication barrier is effectively weak; conversely, instances kept on a trusted LAN face lower realistic risk. Prioritize patching on any internet-exposed or multi-user instance.

An attacker with a valid (or self-registered) ConvertX account submits a file to the /upload endpoint using a crafted file.name containing path traversal sequences, since the filename is written to disk via Bun.write without sanitization. By directing the write to overwrite a system binary or an executable the server later invokes, the attacker achieves arbitrary code execution on the host. Public exploit details are available via the GitHub Security Advisory (GHSA-cpww-gwgc-p72r), lowering the bar for weaponization.