CVE-2026-59976 in ConvertX
Summary
by MITRE • 10/12/2026
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. This issue is fixed in version 0.18.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
ConvertX operates as a self-hosted file conversion service designed to handle various media formats through automated processing pipelines. A critical security vulnerability exists within the ImageMagick converter component prior to version 0.18.0, stemming from improper input validation and path sanitization mechanisms. The core technical flaw involves the handling of the convert_to parameter, which dictates the destination directory for processed files. When a user submits an image file without a standard extension via the /convert endpoint, the application fails to adequately sanitize or validate this parameter before constructing the final output filesystem path. This lack of rigorous validation allows attackers to inject directory traversal sequences, such as ../, into the convert_to field.
The operational impact of this vulnerability is severe due to its potential for arbitrary file write operations within the container environment. By exploiting the unsanitized input, an authenticated user or an unauthenticated user if the service permits public access can manipulate the constructed path to escape the intended output directory. This capability enables the attacker to overwrite critical system files, inject malicious scripts into web-accessible directories, or corrupt essential configuration files. Such actions can lead to a complete compromise of the host environment's integrity, resulting in data loss, unauthorized code execution, or a denial of service condition by disrupting core application functionality.
From an industry standards perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which covers cases where software does not properly neutralize special elements that can cause paths to transition outside of the intended directory structure. Furthermore, the exploitation technique aligns with MITRE ATT&CK tactic T1083: File and Directory Discovery, followed by T1564: Hidden Files and Directories or T1222: File Permission Modification depending on the specific overwrite target. The vulnerability highlights a common risk in file handling operations where user-supplied input is directly concatenated into filesystem paths without sufficient boundary checks.
To mitigate this issue, organizations must upgrade ConvertX to version 0.18.0 or later, which implements proper sanitization of the convert_to parameter and enforces strict directory confinement for output files. In environments where upgrading is not immediately feasible, administrators should restrict access to the /convert endpoint by enforcing strong authentication mechanisms and disabling unauthenticated access if possible. Additionally implementing a robust input validation layer that rejects any path segments containing traversal characters or absolute paths can provide an additional defense-in-depth measure against this class of directory traversal attacks.