ConvertX anfällig für willkürliches Löschen von Dateien durch Pfadüberschreitung in `POST /delete`

The primary impact of this vulnerability is the potential for unauthorized file deletion. An attacker can leverage path traversal sequences (e.g., ../) within the filename parameter to bypass intended restrictions and delete files outside the intended uploads directory. The extent of damage depends on the permissions of the server process running ConvertX; an attacker with sufficient privileges could potentially delete critical system files, leading to denial of service or even complete system compromise. This vulnerability shares similarities with other path traversal exploits where attackers gain unauthorized access to sensitive data or system resources.

Self-hosting users of ConvertX are at risk, particularly those running versions prior to 0.17.0. Shared hosting environments where ConvertX is installed may also be vulnerable if the hosting provider has not applied the necessary security updates. Users who have configured ConvertX with overly permissive file system permissions are at higher risk.

1. 2026-01-27Disclosure

   disclosure

1. Reserviert2026-01-26
2. Veröffentlicht2026-01-27
3. Geändert2026-01-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24741 is to immediately upgrade ConvertX to version 0.17.0 or later, which includes the necessary validation to prevent path traversal. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing path traversal sequences in the filename parameter of the /delete endpoint. Additionally, review file system permissions to ensure the ConvertX process has the minimum necessary privileges to operate. Regularly monitor server logs for suspicious activity, specifically attempts to access or delete files outside the expected upload directory.