CVE-2026-54732

Deferred Deferred - Pending Action

Path Traversal in libreoffice-convert

Publication date: 2026-08-27

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-54732

Affected Vendors & Products

Vendor	Product	Version / Range
elwerene	libreoffice-convert	to 1.8.2 (exc)
libreoffice	libreoffice-convert	1.8.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the libreoffice-convert Node.js module affecting versions prior to 1.8.2. It allows attackers to write files to arbitrary locations by including path traversal sequences like ../ in the filename parameter. The library uses caller-controlled input directly in path.join without sanitizing it to a base name, enabling escape from the intended temporary directory.

Detection Guidance

Check if your system uses libreoffice-convert version prior to 1.8.2 by running: npm list libreoffice-convert. If the version is below 1.8.2, the system is vulnerable. Inspect application logs for unusual file writes or path traversal patterns in filenames.

Impact Analysis

An attacker could exploit this to overwrite critical system files such as SSH authorized_keys, cron configurations, or web root files. This could lead to remote code execution, privilege escalation, or denial of service. The impact depends on the permissions of the running process.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized access to sensitive files may result in compliance breaches, data leaks, or unauthorized system modifications.

Mitigation Strategies

Upgrade libreoffice-convert to version 1.8.2 or later using: npm update libreoffice-convert. If upgrading is not possible, manually sanitize filenames using path.basename() before passing them to the library to prevent path traversal.

Hi! I’m here to help you understand CVE-2026-54732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70