Vulnerability Overview
CVE ID: CVE-2026-24741
Product: ConvertX
Affected Versions: All versions prior to 0.17.0
Fixed Version: 0.17.0 and later
Severity: High
CVSS v3.1 Base Score: 8.1 (High)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low (any user or role permitted to access the delete endpoint)
User Interaction: None
Impact: High impact on Integrity and Availability
Executive Summary
A high-severity path traversal vulnerability exists in ConvertX versions earlier than 0.17.0. The issue is present in the file deletion functionality, where user-supplied input is directly used to construct filesystem paths without sufficient validation or restriction. By manipulating the filename parameter in the delete endpoint, an attacker can traverse outside the intended directory and delete arbitrary files on the underlying operating system, limited only by the permissions of the ConvertX process.
While this vulnerability does not directly allow remote code execution, the ability to delete sensitive files can lead to severe outcomes such as service disruption, data loss, deletion of configuration or credential files, and indirect enablement of further attacks.
Technical Description
The vulnerability arises from improper handling of file paths in the delete endpoint (commonly exposed as POST /delete). The application accepts a filename parameter from the client and performs a file deletion operation (for example, via an unlink() system call) without validating whether the resolved path remains within the intended upload or working directory.
Path traversal sequences such as ../ (and encoded equivalents) are not filtered or normalized. As a result, the constructed path may point to locations outside the application’s directory structure.
Root Cause
- Lack of canonical path resolution before file deletion
- Absence of directory allowlisting or boundary checks
- Trust placed in client-controlled input for filesystem operations
Exploitation Scenario
- A ConvertX instance is exposed on a network (internal or external).
- An attacker sends a crafted HTTP request to the delete endpoint.
- The
filenameparameter contains path traversal sequences. - The application resolves the path and deletes the referenced file.
- Any file writable by the ConvertX process can be removed.
This can result in:
- Deletion of application configuration files
- Removal of uploaded or processed files
- Service crash due to missing dependencies
- Erasure of logs to hide activity
- Disruption of system or container operation
Example Payloads For Educational Purposes Only
Form-Encoded Request
POST /delete HTTP/1.1
Content-Type: application/x-www-form-urlencoded
filename=../../../../etc/passwd
URL-Encoded Traversal
filename=..%2F..%2F..%2F..%2Fvar%2Fwww%2Fconvertx%2Fconfig.json
JSON Request Body
POST /delete
Content-Type: application/json
{
"filename": "../../../../../var/log/convertx/app.log"
}
These payloads demonstrate how directory traversal can be used to escape the intended directory and target arbitrary files.
Proof of Concept (PoC) Status
No publicly released, ready-to-use exploit or proof-of-concept script has been identified. However, due to the simplicity of the flaw, exploitation does not require advanced techniques. Crafting a basic HTTP request with traversal sequences is sufficient to validate the issue on vulnerable systems.
Any testing should only be conducted in environments where explicit authorization has been granted.
MITRE Classification
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Detection and Monitoring Guidance
Relevant Log Sources
- Web server access logs (nginx, Apache)
- Application logs generated by ConvertX
- Host-level audit logs (Linux auditd, file integrity monitoring tools)
- Container runtime logs (if deployed in Docker or Kubernetes)
- WAF or reverse-proxy logs
Indicators of Exploitation
- HTTP
POSTrequests to/deletecontaining:../%2e%2e%2fcombined with traversal patterns
- File deletion events involving:
- System directories (
/etc,/var,/usr) - Application configuration files
- Logs disappearing unexpectedly
- System directories (
- Application errors related to missing files or permission issues shortly after delete requests
Detection Logic
Access Log Pattern Matching
POST /delete
filename=.*\.\./
filename=.*%2e%2e
Behavioral Correlation
- A delete request followed closely by:
- Application crash
- Missing configuration files
- Host audit events showing file removal outside the uploads directory
Impact Assessment
- Integrity: High – unauthorized deletion of critical files
- Availability: High – service disruption or complete outage
- Confidentiality: None directly, but indirect exposure may occur if deletions alter system behavior
Mitigation and Remediation
Immediate Actions
- Restrict access to the delete endpoint using network controls or authentication rules.
- Apply temporary WAF rules to block traversal patterns in request bodies.
Permanent Fix
- Upgrade ConvertX to version 0.17.0 or later, which includes proper path validation and protection against traversal attacks.
Official patch / upgrade link:
https://github.com/C4illin/ConvertX/releases/tag/v0.17.0
Post-Patch Hardening Recommendations
- Ensure ConvertX runs under a dedicated, least-privileged system user.
- Limit filesystem permissions strictly to required directories.
- Enable detailed audit logging for file deletion operations.
- Maintain regular backups of configuration and uploaded data.
- Periodically review logs for abnormal delete activity.
Risk Rating and Priority
Given the low complexity of exploitation and the potentially destructive impact, this vulnerability should be treated as high priority. Systems exposed to untrusted users or networks should be patched without delay.
Final Takeaway
This vulnerability highlights the risks of trusting user-controlled input in filesystem operations. While the flaw is conceptually simple, the consequences can be severe. Prompt patching combined with basic operational hardening significantly reduces the risk of exploitation.
