CVE-2026-85618 in ConvertX
Summary
by MITRE • 09/04/2026
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
ConvertX version 0.17.0 contains a critical insecure deserialization vulnerability within its xelatex conversion module, classified under CWE-284 as Improper Access Control. This flaw stems from the application's failure to properly sanitize or restrict user-supplied input when processing LaTeX documents for PDF generation. The core technical issue lies in how the underlying TeX engine processes specific commands that allow file system interaction. Specifically, the vulnerability is triggered by the presence of \input{path} or \verbatiminput{path directives within an uploaded .tex file. These directives are standard LaTeX commands intended to include content from external files into a document during compilation. However, in this vulnerable implementation, there are no safeguards preventing these paths from pointing to arbitrary locations on the server's filesystem rather than just relative resources within the application's designated directory structure.
The operational impact of this vulnerability is severe for any organization relying on ConvertX for document conversion services. Because the xelatex process typically runs with specific system privileges required to render complex documents, an authenticated attacker can exploit these directives to read sensitive files accessible by that user account. This includes configuration files containing database credentials, private keys, source code repositories, or other confidential data stored on the server. The attack vector is straightforward and does not require privilege escalation beyond the initial authentication layer; once logged in, a malicious actor simply uploads a crafted LaTeX file containing the malicious input directives. Upon conversion to PDF, the TeX engine executes the read operation, effectively bypassing standard web application security controls that might otherwise restrict access to sensitive directories.
This vulnerability aligns with MITRE ATT&CK technique T1083, which covers File and Directory Discovery, as well as T1560, Archive Collected Data, if the attacker uses this information for further exfiltration. The lack of path canonicalization or allow-listing mechanisms allows the application to traverse directory boundaries using relative paths such as ../../etc/passwd on Linux systems or C:\Windows\System32\drivers\etc\hosts on Windows environments. This behavior violates fundamental security principles regarding least privilege and input validation, exposing the organization to significant data breach risks under regulations like GDPR or HIPAA if sensitive personal health information or personally identifiable information is stored in accessible locations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective short-term fix involves upgrading ConvertX to a patched version where this vulnerability has been resolved by the vendor through strict input validation and path canonicalization checks before passing data to the TeX engine. If an upgrade is not immediately feasible, administrators should implement web application firewall rules that detect and block LaTeX commands known to cause file system access, such as \input or \verbatiminput. Additionally, running the conversion service in a restricted sandbox environment with minimal filesystem permissions can limit the scope of files accessible even if exploitation occurs. Regular security audits focusing on third-party library usage and strict allow-listing of permitted input paths are essential to prevent similar vulnerabilities from being introduced in future updates.