CVE-2026-6636 Details
Description
A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of the component API. Performing a manipulation of the argument pathname results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
A path traversal vulnerability has been identified in the p2r3 convert project, specifically in the buildCache.js file within the API component. The issue arises in the Bun.serve function, where the pathname argument is manipulated without proper sanitization, allowing remote attackers to access files outside the intended directory. This vulnerability affects version 1.0.0 and prior releases up to the commit 6998584ace3e11db66dff0b423612a5cf91de75b.
It is recommended to implement proper path validation and normalization in the file server logic. The application should ensure that requested paths do not traverse outside the intended directory before accessing files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 20, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dave-gilmore-aus/security-advisories/blob/main/convert-advisory | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/submit/793436 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358270 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358270/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| p2r3 convert | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |