What’s Vulnerable › Vulnerabilities

CVE-2026-54732: libreoffice-convert: path traversal / arbitrary file write

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-09-09
• Weakness: CWE-22

Description

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.

Affected products

• elwerene libreoffice-convert: before 1.8.2

References

• https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b
• https://github.com/elwerene/libreoffice-convert/security/advisories/GHSA-gmxc-r82q-347r

Get alerted when CVE-2026-54732 or the next vulnerability affects your stack