EUVD-2026-71225
GHSA-g238-2mw5-49xx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low complexity; low privilege (authenticated user); no scope change; confidentiality-only impact as files are read but not modified.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.
AnalysisAI
Arbitrary file read in ConvertX 0.17.0 allows authenticated users to exfiltrate files accessible to the server process by exploiting the xelatex converter's handling of LaTeX directives. Crafted .tex files containing \input{path} or \verbatiminput{path} directives cause the TeX engine to read and embed target file contents into downloadable PDF output, bypassing any application-level access controls on those files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user account on the ConvertX instance (PR:L - low privilege, any standard user account suffices). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately characterizes this as a medium-high severity, network-exploitable vulnerability requiring only authenticated low-privilege access with low complexity - even a mid-sized municipal IT team in swidnica running ConvertX for document processing should treat this as urgent if untrusted users have accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to ConvertX v0.18.0 or later, where the xelatex converter has been patched per the upstream fix at https://github.com/C4illin/ConvertX/blob/v0.18.0/src/converters/xelatex.ts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of ConvertX 0.17.0 in production and restrict file conversion capabilities to trusted workflows pending patching; review application logs for unusual file access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today