CVE-2025-66449

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66449
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66449.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-66449
Aliases
  • GHSA-cpww-gwgc-p72r
Published
2025-12-16T00:10:49.204Z
Modified
2026-02-07T02:53:14.776554Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution
Details

ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint /upload allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes file.name directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-434",
        "CWE-73"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66449.json"
}
References

Affected packages

Git / github.com/c4illin/convertx

Affected ranges

Type
GIT
Repo
https://github.com/c4illin/convertx
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5268838975fcea560be14901f891ed406e404a34

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.14.0
v0.14.1
v0.15.0
v0.15.1
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.4.1
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66449.json"