CVE-2026-105080: Critical severity ConvertX ConvertX vulnerability
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
ConvertX versions before 0.19.0 are affected when they process Calibre recipe files with a .recipe or .downloaded_recipe extension. Version 0.19.0 includes a change to block these files.
What does an attacker need to exploit this?
An attacker needs privileges to submit or cause ConvertX to process a crafted recipe file. No user interaction is required once the malicious file is passed to the Calibre ebook-convert program.
What is the impact of processing a malicious recipe file?
Recipe files can contain executable code, which ConvertX passes to Calibre's ebook-convert program. Successful exploitation can result in high confidentiality, integrity, and availability impact, including impact beyond the vulnerable component's security scope.
What can be done before upgrading?
Do not allow .recipe or .downloaded_recipe files to be submitted for conversion, and prevent untrusted users or automated workflows from supplying those file types to ConvertX.