Vulnerability Description
ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unlink` without sufficient validation. By supplying path traversal sequences (e.g., `../`), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| C4Illin | Convertx | < 0.17.0 |
Related Weaknesses (CWE)
References
- https://github.com/C4illin/ConvertX/commit/7a936bdc0463936463616381ca257b13babc5Patch
- https://github.com/C4illin/ConvertX/security/advisories/GHSA-w372-w6cr-45jpExploitVendor Advisory
FAQ
What is CVE-2026-24741?
CVE-2026-24741 is a vulnerability with a CVSS score of 8.1 (HIGH). ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unli...
How severe is CVE-2026-24741?
CVE-2026-24741 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24741?
Check the references section above for vendor advisories and patch information. Affected products include: C4Illin Convertx.