CVE-2026-59976 Details
Description
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
A path traversal vulnerability has been identified in ConvertX versions prior to 0.18.0, specifically within the ImageMagick converter. The issue arises because the application uses the unsanitized 'convert_to' parameter to build an output path. This vulnerability allows an authenticated user, or an unauthenticated user if ConvertX is set to allow such access, to upload an extensionless image and inject directory traversal sequences into the 'convert_to' parameter via the '/convert' endpoint. As a result, the output is written to arbitrary locations within the container, potentially overwriting important files or causing a denial-of-service condition.
Users can upgrade to ConvertX version 0.18.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/C4illin/ConvertX/commit/0965928949319e2839770fbf57a8337440d42630 | [email protected] | Source CodeVendor |
| https://github.com/C4illin/ConvertX/pull/532 | [email protected] | Issue TrackingVendor |
| https://github.com/C4illin/ConvertX/releases/tag/v0.18.0 | [email protected] | Release NotesVendor |
| https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| C4illin ConvertX | <= 0.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |