ConvertX: Cross-site request forgery enables deletion of job history
Summary
ConvertX, a self-hosted file conversion service, deletes jobs through an HTTP GET request on /delete/{id} that has no CSRF protection. If a logged-in user visits attacker-controlled content, the browser sends the session cookie and the targeted job is deleted, causing loss of converted-file history. The attacker cannot read files, and the attack requires the victim to be logged in and to visit the malicious page.
Affected
- ConvertX versions prior to 0.18.0
- Vulnerable endpoint: /delete/{id}
Fixed in
- Version 0.18.0 (fix commit e1253267208e439f28c4ffcaff7a81d62cdffadb per the vendor advisory GHSA-63w7-h5q8-hcrj; confirm the commit is contained in the v0.18.0 tag)
Workaround
- No vendor workaround documented.
- Until patched: restrict access to trusted networks or VPN, limit the number of accounts, and avoid using the same browser for ConvertX and general browsing.
Exploitation
- Not known to be exploited (CISA SSVC: exploitation none, automatable no).
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Update ConvertX to version 0.18.0 or later, including packages from Umbrel or TrueNAS.
- Check whether the instance is reachable from the internet and restrict access if possible.
- Back up the data volume so that job history can be restored if needed.
- Monitor for unexpected loss of job history.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-63w7-h5q8-hcrj github.com
- Fix commit e1253267208e439f28c4ffcaff7a81d62cdffadb github.com
- ConvertX Release v0.18.0 github.com
- OSV: CVE-2026-59977 osv.dev
- VulDB entry 417198 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:57.
Original description (NVD)
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.