CVE-2026-108694 in ConvertX
Summary
by MITRE • 10/11/2026
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/11/2026
ConvertX versions through 0.19.0 are susceptible to an arbitrary file read vulnerability stemming from improper handling of input data during document conversion processes. This security flaw specifically affects authenticated users who possess valid credentials for the application, allowing them to bypass intended access controls and retrieve sensitive information stored on the server's filesystem. The root cause lies in the implementation details within the src/converters/pandoc.ts module, which serves as an interface between the ConvertX application logic and the Pandoc document conversion utility. When processing user-uploaded documents, particularly those formatted in reStructuredText, the system fails to enforce strict sandboxing constraints on the underlying command execution environment.
The technical mechanism of exploitation involves uploading a maliciously crafted reStructuredText file that contains an include directive pointing to an absolute path outside the intended application directory structure. Upon initiating the conversion process, ConvertX invokes Pandoc without utilizing the --sandbox flag, which is designed to restrict access to files and directories not explicitly allowed by the converter's security policy. Without this protective measure, Pandoc processes the include directive literally, reading the contents of the specified absolute path from the server's file system. The converted output then incorporates these external file contents, effectively allowing the attacker to exfiltrate data that should remain inaccessible through normal application functions.
This vulnerability represents a classic instance of insecure direct object references combined with command injection risks inherent in wrapper scripts for powerful utilities like Pandoc. From an industry standard perspective, this aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code Command Injection. The lack of input validation regarding file paths included within the document structure permits traversal beyond authorized boundaries. Furthermore, because the vulnerability relies on authenticated access, it underscores the importance of implementing defense-in-depth strategies where even privileged users are subject to strict operational constraints that limit their ability to interact with system resources outside defined scopes.
The operational impact of this flaw is significant for organizations relying on ConvertX for document processing workflows. Attackers can potentially read configuration files containing database credentials, private keys, source code repositories, or other sensitive business data residing in accessible directories on the server host. This compromise undermines the confidentiality integrity and availability principles by exposing critical infrastructure details that could facilitate further attacks such as privilege escalation or lateral movement within a networked environment. The ability to download arbitrary file contents transforms what might appear as a simple document conversion feature into a powerful information disclosure vector, potentially leading to full system compromise if combined with other vulnerabilities in the surrounding ecosystem.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. For ConvertX versions prior to 0.19.1, administrators should upgrade to patched releases where this issue has been addressed by enforcing sandboxing modes or restricting allowed include paths strictly within designated directories. In environments where upgrading is not immediately feasible, implementing a reverse proxy with strict input filtering can help block requests containing suspicious absolute path patterns in reStructuredText files before they reach the application layer. Additionally, running ConvertX under a dedicated service account with minimal file system permissions ensures that even if an attacker succeeds in reading files, the scope of accessible data is severely limited by operating system level access controls.
From a threat intelligence standpoint, this vulnerability maps to MITRE ATT&CK technique T1083: File and Directory Discovery, as well as T1567: Exfiltration Over Web Service if the exfiltrated data is transmitted externally via HTTP requests triggered during or after conversion. Security teams should monitor logs for unusual patterns in document upload sizes or frequent access to system directories through the application interface. Regular audits of third-party dependencies and their configurations are essential, as wrappers around powerful command-line tools often introduce subtle security gaps if default safe behaviors like sandboxing are not explicitly enabled by developers. Ensuring that all external commands invoked by web applications adhere to strict allow-lists for file paths prevents similar vulnerabilities in future iterations or related software components.