What’s Vulnerable › Vulnerabilities

CVE-2026-24741: ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-22

Description

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unlink` without sufficient validation. By supplying path traversal sequences (e.g., `../`), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.

Affected products

• C4illin ConvertX: before 0.17.0 — fixed in 0.17.0

How to fix

Upgrade to a fixed version: C4illin ConvertX 0.17.0. Check the vendor advisory for mitigations.

References

• https://github.com/C4illin/ConvertX/commit/7a936bdc0463936463616381ca257b13babc5e77
• https://github.com/C4illin/ConvertX/security/advisories/GHSA-w372-w6cr-45jp

Get alerted when CVE-2026-24741 or the next vulnerability affects your stack