CVE-2026-24741: Path Traversal in ConvertX

The primary impact of this vulnerability is the potential for unauthorized file deletion. An attacker can leverage path traversal sequences (e.g., ../) within the filename parameter to bypass intended restrictions and delete files outside the designated uploads directory. The extent of damage depends on the permissions granted to the server process running ConvertX. Successful exploitation could lead to data loss, system instability, or even complete compromise of the server if critical system files are targeted. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file system structures to gain unauthorized access.

1. Reserved2026-01-26
2. Published2026-01-27
3. Modified2026-01-28
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade ConvertX to version 0.17.0 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict the permissions of the server process running ConvertX to minimize the impact of potential file deletions. Implement strict filename validation on the /delete endpoint to prevent path traversal sequences. Consider using a Web Application Firewall (WAF) to filter malicious requests containing path traversal attempts. After upgrading, confirm the fix by attempting a deletion request with a path traversal sequence (e.g., /delete?filename=../../../../etc/passwd) and verifying that the request is rejected.