CVE-2026-24741

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24741

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24741.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24741

Aliases

GHSA-w372-w6cr-45jp

Published

2026-01-27T21:11:57.295Z

Modified

2026-03-01T02:56:54.452239Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`

Details

ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the POST /delete endpoint uses a user-controlled filename value to construct a filesystem path and deletes it via unlink without sufficient validation. By supplying path traversal sequences (e.g., ../), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24741.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/c4illin/convertx

Affected ranges

Type: GIT
Repo: https://github.com/c4illin/convertx
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

6c812b44bb25bfaf00c7ad2c8a1b57a64e8bdc21

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.10.1

v0.11.0

v0.11.1

v0.12.0

v0.12.1

v0.13.0

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.16.0

v0.16.1

v0.2.0

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.1

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.8.1

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24741.json"