CVE-2026-59977: ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ConvertXto a version that resolves this vulnerability.Fixed in 0.18.0
Event History
Frequently Asked Questions
Which deployments are affected?
ConvertX versions prior to 0.18.0 are affected. The issue applies to the permanent-deletion /delete/{id} endpoint.
What must an attacker do to trigger deletion?
An attacker needs to cause an authenticated ConvertX user to visit attacker-controlled content that requests the targeted /delete/{id} URL. The browser then sends the user's session cookie with the request.
What is the impact of successful exploitation?
The targeted conversion job is permanently deleted, causing unauthorized loss of converted-file history. The provided information does not indicate confidentiality impact.
How can I remediate this issue?
Upgrade ConvertX to version 0.18.0, which fixes the issue.