C4illin vulnerabilities

🔔 Create alert RSS

Published CVEs affecting C4illin products: 6 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-59977 High · 8.1 CWE-352 Oct 12, 2026

ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.

CVE-2026-59976 High · 8.1 CWE-22 Oct 12, 2026

ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.

CVE-2026-108694 Medium · 6.5 CWE-73 Oct 10, 2026

ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.

CVE-2026-105080 Critical · 9.9 CWE-829 Oct 2, 2026

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and…

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

CVE-2026-24741 High · 8.1 CWE-22 Jan 27, 2026

ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unlink` without sufficient validation. By supplying path traversal sequences (e.g., `../`), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.

CVE-2025-66449 High · 8.8 CWE-22 Dec 15, 2025

ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution

ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.