CVE-2026-59976
highConvertX is a self-hosted file conversion service.
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/C4illin/ConvertX/commit/0965928949319e2839770fbf57a8337440d42630 security-advisories@github.com
- https://github.com/C4illin/ConvertX/pull/532 security-advisories@github.com
- https://github.com/C4illin/ConvertX/releases/tag/v0.18.0 security-advisories@github.com
- https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j security-advisories@github.com
- https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j 134c704f-9b21-4f2e-91b3-4a467353bcc0