CVE-2026-85618
Received Received - Intake

Arbitrary File Read in ConvertX 0.17.0 via LaTeX Input Directive

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85618
EUVD
EUVD-2026-71225

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
c4illin convertx to 0.18.0 (inc)
c4illin convertx to 0.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ConvertX 0.17.0 has an arbitrary file read vulnerability in its xelatex converter. Authenticated users can upload specially crafted LaTeX files containing input directives like \input{path} or \verbatiminput{path}. When processed, these directives cause the TeX engine to read arbitrary files accessible to the server and include them in the generated PDF output.

Detection Guidance

Check for unusual LaTeX file uploads or PDF generation requests in ConvertX logs. Monitor for requests containing \input{ or \verbatiminput{ directives in uploaded .tex files. Inspect PDF outputs for unexpected file contents like /etc/passwd or environment variables.

Impact Analysis

An attacker can read sensitive files on the server such as /etc/passwd, /etc/shadow, environment variables (like JWT_SECRET), application config files, source code, or database files. The PDF output exposes this data, allowing direct download of confidential information. Since latexmk runs with server permissions (often root), any readable file can be accessed.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory obligations for data security and access controls.

Mitigation Strategies

Upgrade ConvertX to the latest version beyond 0.18.0. Disable or restrict user registration if open by default. Implement sandboxing for xelatex converter processes. Review and restrict file permissions for the server process. Monitor for suspicious PDF generation activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85618. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart