EUVD-2026-97763Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate or reach open instance
-
DeliveryUpload extensionless image to /convert
-
ExploitSupply traversal sequences in convert_to
-
ExecutionImageMagick writes outside output dir
-
PersistOverwrite arbitrary container files
-
ImpactCorruption or denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires: (1) network access to the ConvertX /convert endpoint; (2) an authenticated account by default, OR no authentication if the instance is specifically configured to allow unauthenticated access; (3) uploading an extensionless image file so the output filename is derived directly from convert_to; and (4) supplying directory-traversal sequences (../, / or \) in the convert_to parameter. Affected versions are all releases prior to 0.18.0. Limiting factors: default deployments require a valid user account, the fix in 0.18.0 explicitly rejects convert_to values containing '/', '\', or '..', and impact is write/overwrite within the container filesystem (integrity/availability) rather than data disclosure. |
| Impact | This is a credible, above-average-priority issue but not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high integrity and availability impact and no confidentiality impact - consistent with a CWE-22 path traversal that writes attacker-controlled output to arbitrary container paths rather than reading data. EPSS and KEV data were not supplied, so exploitation probability and active-exploitation status are unknown; there is no indication this is on CISA KEV. No standalone proof-of-concept exploit was provided - the only code evidence is the vendor's own patch diff (PR #532), which confirms the vulnerable logic but is not weaponized exploit code. One notable tension: the CVSS sets PR:L (authenticated), but the description states exploitation is also possible by an unauthenticated user when ConvertX is deployed in its allow-unauthenticated-access mode, so real-world required privileges depend on deployment configuration - in that non-default mode the effective privilege requirement drops toward PR:N. Overall this is a genuine risk for exposed ConvertX instances, moderated by its niche self-hosted footprint and the fact that default deployments require an authenticated account. |
| Exploit ScenarioDerived | An authenticated user (or any user if the instance is configured to allow unauthenticated access) uploads an extensionless image and submits a crafted convert_to value containing directory-traversal sequences (e.g. ../../) via the /convert endpoint. Because convert_to is used unsanitized to build the ImageMagick output path, the converted file is written outside the intended output directory to an arbitrary path inside the container, overwriting existing files and potentially corrupting the application or causing denial of service. No public exploit was provided, but the patch diff publicly reveals the vulnerable code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Path traversal in ConvertX (all releases prior to 0.18.0) lets an authenticated user write converted output files to arbitrary paths inside the container by supplying traversal sequences in the convert_to parameter of the /convert endpoint. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H reflects that exploitation requires a valid account by default, though instances deliberately configured for unauthenticated access lower that bar to anyone who can reach the service; the payoff is integrity and availability impact - overwriting files or causing denial of service - rather than data disclosure. A vendor fix is available in 0.18.0 (upstream PR 532, commit 0965928), and no public exploit code or confirmed active exploitation was identified at time of analysis, keeping this a credible above-average-priority issue rather than a top-tier emergency.
RemediationAI
Primary fix: upgrade ConvertX to 0.18.0 or later (vendor release: https://github.com/C4illin/ConvertX/releases/tag/v0.18.0; advisory: https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j), which adds an explicit rejection of convert_to values containing '/', '\', or '..' and correctly handles extensionless uploads (PR https://github.com/C4illin/ConvertX/pull/532, commit https://github.com/C4illin/ConvertX/commit/0965928949319e2839770fbf57a8337440d42630). If upgrading immediately is not possible, apply these compensating controls with their trade-offs in mind: disable unauthenticated access and require accounts (removes the no-auth variant of the attack but blocks legitimate anonymous/guest use cases); if accounts cannot be enforced, put the /convert endpoint behind a reverse proxy that authenticates requests or allowlists trusted source IPs (risk of breaking integrations and adding a proxy dependency); run the container with a read-only root filesystem and mount only a dedicated, narrow output volume, with the process running as a non-root user (this converts the arbitrary-write primitive into failures on paths outside the volume, but requires reworking any workflow that writes elsewhere in the container and can surface as conversion errors); reject or normalize multipart uploads whose filenames lack an extension and validate/sanitize the convert_to field at the proxy or WAF layer before it reaches the app (defense in depth only, since upstream sanitization was absent and proxy rules may be bypassed by encoding variants); and monitor for traversal patterns such as '../', absolute paths, or backslashes in convert_to as a detection signal. No vendor-released patch exists for versions below 0.18.0, so upgrading remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory, localized in ConvertX's ImageMagick converter pipeline (src/converters/main.ts) and in the /convert route handler (src/pages/convert.tsx, an Elysia service). When a user uploads an extensionless image, the original filename has no dot, so the converter's filename-derivation logic does not strip an extension and instead builds the output filename from user-controlled input; the unsanitized convert_to parameter is then joined into the output path, and traversal sequences such as ../, /, or \ escape the intended output directory. The upstream patch hardens two points: the convert route now rejects any convert_to value containing '/', '\', or '..', and the converter now explicitly handles the extensionless case by appending the new extension (fileName + '.' + newFileExt) instead of running its extension-stripping regex on a filename with no extension. CPE data (cpe:2.3:a:c4illin:convertx:*:*:*:*:*:*:*:*) confirms every release before the fix is in scope. Because ConvertX runs as a self-hosted file-conversion service, the write primitive is scoped to the container filesystem the process can reach - converted output can land on arbitrary container paths, with impact limited to overwriting existing files or exhausting/breaking service operation rather than exfiltrating data.
Know when Convertx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network endpoint, low complexity, no confidentiality impact; PR:L reflects the default authenticated requirement despite a configurable unauthenticated mode; arbitrary file overwrite yields high integrity and availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
Technical POC Analysis
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), with the advisory also mapping CWE-73 (External Control of File Name or Path).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ConvertX deployments running any release before 0.18.0 carry an authenticated file-write weakness that allows converted output to be written to arbitrary paths inside the conversion container, which can overwrite application files or take the service offline. Any team running ConvertX as a shared or externally reachable document-conversion utility is exposed, and the barrier to abuse is low - a single valid low-privilege account, or no account at all on instances deliberately configured for unauthenticated access - so the operational risk is downtime and corrupted outputs rather than data theft. No public exploit code or confirmed active exploitation was identified at time of analysis, which makes this a priority remediation item rather than an emergency.
Apply vendor patch (upgrade to ConvertX 0.18.0); until that upgrade is complete, disable unauthenticated access to the service, restrict network reachability to the /convert endpoint, and run the container with a restricted or read-only output mount and a non-root user.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Authenticated arbitrary file write in ConvertX versions prior to 0.16.0 allows a low-privilege user to escape the intend
Arbitrary file deletion in ConvertX prior to version 0.17.0 allows authenticated attackers to remove files outside the i
Authenticated low-privileged users of ConvertX before 0.19.0 can execute arbitrary Python code on the server by submitti
Cross-site request forgery in ConvertX versions prior to 0.18.0 lets an attacker permanently delete an authenticated use
Arbitrary file read in ConvertX 0.17.0 allows authenticated users to exfiltrate files accessible to the server process b
Authenticated file read in ConvertX through 0.19.0 allows any logged-in user to retrieve arbitrary files from the server
Exploit-DB