CVE-2026-108694: ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ConvertX user can exploit it. The attacker needs access to upload a reStructuredText document, request conversion through the Pandoc converter, and download the resulting output.
What is required to read a server file?
The uploaded reStructuredText document must contain an include directive that names an absolute path on the server. Pandoc then processes that directive during conversion, and the downloaded output can contain the referenced file's contents.
Are files only exposed through a particular conversion path?
The described exposure is specific to conversions handled by the Pandoc converter. It results from Pandoc being invoked without the --sandbox flag.
What versions are known to be affected?
ConvertX through version 0.19.0 is affected.