CVE-2025-66449: Path Traversal in ConvertX

The primary impact of CVE-2025-66449 is the potential for remote code execution. An attacker, after authenticating to the ConvertX instance, can exploit the /upload endpoint to upload files with arbitrary names. Crucially, the application does not sanitize the filename provided by the user. This allows an attacker to overwrite system binaries with malicious versions, effectively gaining control of the server. The blast radius extends to the entire server infrastructure, as successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the ConvertX process. This vulnerability shares similarities with other file upload vulnerabilities where insufficient input validation allows for arbitrary file writes, potentially leading to system compromise.

1. Reserved2025-12-01
2. Published2025-12-16
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66449 is to immediately upgrade ConvertX to version 0.16.0 or later, which contains the necessary patch. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict file upload permissions to the ConvertX user account, limiting the potential damage from a successful exploit. Implement a Web Application Firewall (WAF) with rules to block requests containing suspicious filenames or path traversal sequences in the /upload endpoint. Carefully review and restrict the directories accessible to the ConvertX process to minimize the impact of potential file overwrites. After upgrading, confirm the fix by attempting to upload a file with a malicious filename (e.g., /../../../../etc/passwd) and verifying that the upload is rejected.