CVE-2026-108694

MEDIUMCVSS 6.5

Description

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.

Timeline

Published:October 11th, 2026 2:16 AM

Last modified:October 18th, 2026 12:16 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-73

References & Reports

Advisories, patches, and third-party reports

https://github.com/C4illin/ConvertX
https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152
https://github.com/C4illin/ConvertX/issues/668
https://www.vulncheck.com/advisories/convertx-through-0.19.0-arbitrary-file-read-via-pandoc-converter

Source: NIST NVD · Data may lag official sources by up to one minute