CVE-2026-108694 Details
Description
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
A vulnerability allowing arbitrary file read has been identified in ConvertX versions through 0.19.0. This issue arises because the application invokes Pandoc for document conversion without the necessary sandboxing, enabling authenticated users to access server files. By uploading a reStructuredText document with an include directive pointing to an absolute file path, users can exploit this vulnerability. The converted output will contain the contents of the referenced file, as Pandoc resolves these directives against the local filesystem when not sandboxed.
Users are advised to update to ConvertX version 0.19.1 or later, where this vulnerability has been addressed by adding the necessary sandboxing to the Pandoc conversion process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/C4illin/ConvertX | [email protected] | ProductSource CodeVendor |
| https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152 | [email protected] | Source CodeVendor |
| https://github.com/C4illin/ConvertX/issues/668 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/convertx-through-0.19.0-arbitrary-file-read-via-pandoc-converter | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| C4illin ConvertX | <= 0.19.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |