CVE-2026-108694— ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
Quick assessment
Affected
C4illin ConvertX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ConvertX 0.19.0 及之前版本存在任意文件读取漏洞。由于 src/converters/pandoc.ts 在调用 Pandoc 时未使用 --sandbox 参数，已认证用户可读取服务器上的任意文件。攻击者可以上传包含绝对路径的 include 指令的 reStructuredText 文档，将其转换为目标格式，然后下载包含被引用文件内容的输出文件，从而窃取敏感信息。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108694
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
Source: CVE Program / CVE List V5
Vulnerability Description
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-108694
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108694
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108694 (1)
Vendor Advisories for CVE-2026-108694 (1)
Proof of Concept for CVE-2026-108694 (2)
IV. Related Vulnerabilities
Same product: ConvertX
-
CVE-2026-59976
ConvertX: Path Traversal vulnerability leading to Arbitrary -
CVE-2026-59977
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unaut -
CVE-2026-105080
ConvertX <0.19.0 远程代码执行漏洞 -
CVE-2026-85618
ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directiv -
CVE-2026-24741
ConvertX Vulnerable to Arbitrary File Deletion via Path Trav
Same vendor: C4illin
-
CVE-2026-59976
ConvertX: Path Traversal vulnerability leading to Arbitrary -
CVE-2026-59977
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unaut -
CVE-2026-105080
ConvertX <0.19.0 远程代码执行漏洞 -
CVE-2026-85618
ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directiv -
CVE-2026-24741
ConvertX Vulnerable to Arbitrary File Deletion via Path Trav
Same weakness: CWE-73
-
CVE-2026-109601
Frappe Framework before v16.30.0 Arbitrary File Read via Out -
CVE-2026-93695
Arbitrary file write through remote file identifiers in Prog -
CVE-2026-108591
InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_up -
CVE-2026-108156
LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory De -
CVE-2026-87685
Brocade Fabric OS任意文件操纵漏洞
V. Comments for CVE-2026-108694
No comments yet