ConvertX: Arbitrary code execution via Calibre recipe files
Summary
ConvertX, a self-hosted online file converter, does not block Calibre recipe files (.recipe and .downloaded_recipe) and passes them to the ebook-convert program. Executable code contained in such files can therefore be run on the server. The CNA rates the issue as critical (CVSS 4.0 base score 9.4) and requires an account with low privileges.
Affected
- ConvertX versions before 0.19.0
- Versions up to 0.18.x are affected according to VulDB
Fixed in
- ConvertX 0.19.0 (upstream release dated 26 Sep 2026)
- Newer releases exist; use the latest stable version and confirm that the fix is included in your build
Workaround
- No vendor workaround found; the fix is an upgrade
- Keep the instance off the internet until it is patched and limit accounts to trusted staff
- Run the service in a segment with limited access to internal systems (recommended by a third-party analysis, not by the vendor)
- Run the container as a non-root user (PUID setting, available since v0.19.0)
- Unknown whether the Calibre converter can be disabled without breaking the application
Exploitation
- Not known to be exploited in the wild
- Not listed in CISA KEV
- No public proof of concept found by aggregators; this is not proof that none exists
- CISA SSVC: exploitation none, automatable no
- EPSS about 0.003
Our recommendation
- Upgrade ConvertX to version 0.19.0 or later, preferably the latest stable release
- If you use a third-party package (e.g. for Synology DSM), check with the packager that it includes the fix
- Until patched, restrict internet exposure and limit who can upload files
- Run the container with limited network access and as a non-root user
- Monitor the container for new or modified files and unusual outbound connections
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
beyavuz/cve-2026-105080-poc
Research sources
- GitHub Security Advisory GHSA-m4hh-rqmf-c8hw github.com
- Fix commit 0ca17dad github.com
- ConvertX release v0.19.0 github.com
- OSV CVE-2026-105080 osv.dev
- VulDB CVE-2026-105080 vuldb.com
- VulnCheck VULNRICHMENT CVE-2026-105080 vulners.com
- TheHackerWire CVE-2026-105080 www.thehackerwire.com
- ConvertX project github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:13.
Original description (NVD)
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.