CVE-2026-59977 in ConvertX
Summary
by MITRE • 10/12/2026
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
ConvertX operates as a self-hosted file conversion service designed to manage document transformations for users. A critical security flaw was identified within versions prior to 0.18.0, specifically affecting the /delete/{id} endpoint responsible for permanently removing conversion jobs from the system history. The vulnerability stems from an improper implementation of state-changing operations using HTTP GET requests rather than POST or other methods that require explicit user intent confirmation through non-idempotent mechanisms. In web application security best practices, any action that modifies server-side data should not be triggerable via simple URL navigation or image tags because browsers automatically include session cookies with every request to the origin domain when following a link or loading an embedded resource.
The technical flaw allows for Cross-Site Request Forgery attacks where an authenticated user can be tricked into deleting specific conversion jobs without their knowledge or consent. When an attacker controls content, such as a malicious webpage or email body containing an image tag with the src attribute set to the ConvertX /delete/{id} endpoint URL, the victim's browser will automatically send this request along with any valid session cookies stored for that domain. This behavior bypasses authentication checks since the server interprets the GET request from the authenticated user as a legitimate deletion command. Consequently, the targeted job is permanently removed from the system, leading to an unauthorized loss of converted-file history and potentially disrupting workflows dependent on those records.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically highlighting the misuse of GET requests for state-changing operations as a contributing factor. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker leverages existing valid credentials by exploiting the trust that web browsers place in session cookies during cross-origin requests. The operational impact includes data integrity compromise and potential denial of service through systematic deletion of historical records, which may hinder audit trails or forensic analysis for users relying on ConvertX for compliance or record-keeping purposes.
To mitigate this vulnerability, developers must ensure that all state-changing endpoints utilize HTTP methods such as POST, PUT, or DELETE rather than GET. Additionally implementing anti-CSRF tokens is essential to verify that the request originates from a legitimate page within the same origin. These tokens should be unique per session and validated server-side before processing any deletion requests. Users running versions prior to 0.18.0 are advised to upgrade immediately to version 0.18.0 or later, where this issue has been resolved by enforcing proper HTTP method usage and potentially adding additional safeguards against unauthorized deletions. Until the update is applied, administrators should consider restricting access to sensitive endpoints through network-level controls or implementing strict Content Security Policy headers that prevent loading resources from untrusted origins if feasible within their deployment architecture.