ConvertX: Path traversal leading to arbitrary file write
Summary
ConvertX is a self-hosted file conversion service. Before version 0.18.0, the ImageMagick converter builds the output path from the unsanitized convert_to parameter, so directory traversal sequences are not blocked. An authenticated user, or an unauthenticated user if unauthenticated access is enabled, can write converted output to arbitrary paths in the container, which may overwrite files or cause a denial of service.
Affected
- ConvertX versions before 0.18.0
- Unauthenticated access must be enabled for exploitation without an account
Fixed in
- Version 0.18.0 (fix in pull request #532)
Workaround
- Unknown. No official workaround is documented; upgrading to 0.18.0 is the vendor's fix.
- Until updated, disable unauthenticated access and restrict network access to the service.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA SSVC lists exploitation as PoC, not automatable, with total technical impact.
- No public proof of concept found.
Our recommendation
- Inventory all ConvertX instances and their versions.
- Upgrade all instances to version 0.18.0 or newer.
- Disable unauthenticated access and keep the service off the public internet or behind VPN/SSO.
- Back up mounted data and limit write access of the container where possible.
- Monitor the service for unexpected files in output or mounted directories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pvqw-vc5x-266j github.com
- ConvertX v0.18.0 release github.com
- Fix commit 0965928 github.com
- Pull request #532 github.com
- OSV CVE-2026-59976 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:57.
Original description (NVD)
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
NVD references (5)
- https://github.com/C4illin/ConvertX/commit/0965928949319e2839770fbf57a8337440d42630
- https://github.com/C4illin/ConvertX/pull/532
- https://github.com/C4illin/ConvertX/releases/tag/v0.18.0
- https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j
- https://github.com/C4illin/ConvertX/security/advisories/GHSA-pvqw-vc5x-266j
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.