EUVD-2026-67161
GHSA-gmxc-r82q-347r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
PR:L because caller must invoke the API with a controlled filename; C:N because this is a write-only primitive with no read capability; I:H for arbitrary file write.
Primary rating from Vendor (https://github.com/elwerene/libreoffice-convert).
CVSS VectorVendor: https://github.com/elwerene/libreoffice-convert
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 78 npm packages depend on libreoffice-convert (71 direct, 7 indirect)
Ecosystem-wide dependent count for version 1.8.2.
DescriptionCVE.org
Impact
options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).
Patches
Version 1.8.2 uses path.basename on filename to make sure the temp directory can not be escaped.
Workarounds
Make sure you supply the filename yourself and don't have it user supplied or use path.basename on filename before using it in libreoffice-convert.
AnalysisAI
Arbitrary file write in the libreoffice-convert npm package (all versions prior to 1.8.2) allows any caller who supplies a user-controlled fileName option to escape the intended temporary directory and overwrite arbitrary filesystem paths accessible to the Node.js process. The root cause is unsanitized use of path.join(tempDir.name, fileName) - a ../-laden filename resolves outside the temp dir without restriction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the consuming application accepts `options.fileName` from untrusted caller or user input and passes it directly to libreoffice-convert without normalization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately represents the mechanics: network-reachable, low complexity, requiring only that the caller can invoke a conversion request with a controlled filename - no elevated OS privilege needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libreoffice-convert to version 1.8.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today