CVE-2026-59976
Received Received - Intake

Path Traversal in ConvertX File Conversion Service

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-59976
EUVD
EUVD-2026-97763

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
C4illin ConvertX < 0.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ConvertX before version 0.18.0 has a path traversal vulnerability in its ImageMagick converter. The convert_to parameter is not sanitized, allowing attackers to include directory traversal sequences like ../ in the output path. This lets authenticated or unauthenticated users (depending on configuration) write files to arbitrary locations on the server, potentially overwriting critical files or causing denial of service.

Detection Guidance

To detect this vulnerability, monitor for unauthorized file writes or suspicious path traversal attempts in ConvertX logs. Check for requests to /convert with convert_to parameters containing sequences like ../, /, or \. Review file system changes outside the intended output directory.

Impact Analysis

An attacker could overwrite system files, application binaries, or configuration files, leading to denial of service or system compromise. They might also replace legitimate files with malicious ones, enabling further attacks. The impact depends on the server's file permissions and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of sensitive information, or system unavailability, all of which are compliance violations.

Mitigation Strategies

Upgrade ConvertX to version 0.18.0 or later immediately. If upgrading is not possible, restrict access to the /convert endpoint and validate all convert_to parameters to reject path traversal sequences like ../, /, or \. Ensure the application runs with minimal privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart