CVE-2026-59976: ConvertX: Path Traversal vulnerability leading to Arbitrary File Write
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convertto through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ConvertXto a version that resolves this vulnerability.Fixed in 0.18.0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Deployments configured to allow unauthenticated access can be exploited without credentials. Otherwise, an attacker needs an authenticated ConvertX account.
What does an attacker need to submit to trigger the arbitrary file write?
The attacker must use the /convert endpoint, upload an image with no filename extension, and provide directory-traversal sequences in the convert_to parameter. The vulnerable ImageMagick converter then constructs an output path outside the intended output directory.
What is the impact limited to?
The write is to arbitrary paths within the ConvertX container. This may allow overwriting files in the container or causing denial of service.
How can this be remediated?
Upgrade ConvertX to version 0.18.0, which fixes the issue.