CVE-2026-24741

Katalog CVE

CVSS 8.1 · High EPSS 0,46%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada c4illin convertx. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unlink` without sufficient validation. By supplying path traversal sequences (e.g., `../`), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.

Rincian

Terbit di NVD

27 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/C4illin/ConvertX/security/advisories/GHSA-w372-w6cr-45jp exploit · advisory vendor
• https://github.com/C4illin/ConvertX/commit/7a936bdc0463936463616381ca257b13babc5e77 patch