CVE-2026-85618: ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can upload LaTeX (.tex) files for processing by the xelatex converter can exploit it. No user interaction is required after the upload.
What files could be exposed?
The attacker can cause the TeX engine to read files that are accessible to the server process. File contents can be incorporated into PDF output that the attacker can download.
What input triggers the file read?
A submitted .tex file containing an \input{path} or \verbatiminput{path} directive can request a server-side file path. The affected component is the xelatex converter.