Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59976— ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

Quick assessment

Affected
C4illin ConvertX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ConvertX 是一款自托管的文件转换服务。在 0.18.0 版本之前，其基于 ImageMagick 的转换功能在处理 参数时存在输入未经验证（未过滤）的问题，攻击者可利用该参数构造输出文件路径。如果经过身份认证的用户（或者在 ConvertX 配置为允许未经认证访问的情况下，未经认证的用户）上传一个不带扩展名的图片，并通过 端点在 参数中注入目录遍历序列（如 ），则可导致生成的输出路径逃逸至预期的输出目录之外。攻击者借此能够将转换后的文件写入任意容器路径，可能导致关键文件被覆盖或引发拒绝服务（DoS）攻击。该

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1222.002 · Linux and Mac Permissions

Affected Version Matrix 1

VendorProduct Version RangeStatus
C4illin ConvertX < 0.18.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59976

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ConvertX: Path Traversal vulnerability leading to Arbitrary File Write
Source: CVE Program / CVE List V5
Vulnerability Description
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
C4illin ConvertX < 0.18.0 -

II. Public POCs for CVE-2026-59976

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59976

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59976 (2)

Vendor Advisories for CVE-2026-59976 (1)

Other References for CVE-2026-59976 (1)

IV. Related Vulnerabilities

Same product: ConvertX
Same vendor: C4illin
Same weakness: CWE-22

V. Comments for CVE-2026-59976

No comments yet

Leave a comment