GHSA-gmxc-r82q-347r

Source

https://github.com/advisories/GHSA-gmxc-r82q-347r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gmxc-r82q-347r/GHSA-gmxc-r82q-347r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gmxc-r82q-347r

Aliases

CVE-2026-54732

Published

2026-08-27T17:23:16Z

Modified

2026-08-27T17:40:40Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

libreoffice-convert vulnerable to path traversal / arbitrary file write

Details

Impact

options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).

Patches

Version 1.8.2 uses path.basename on filename to make sure the temp directory can not be escaped.

Workarounds

Make sure you supply the filename yourself and don't have it user supplied or use path.basename on filename before using it in libreoffice-convert.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-27T17:23:16Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / libreoffice-convert

Package

Name: libreoffice-convert; View open source insights on deps.dev
Purl: pkg:npm/libreoffice-convert

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gmxc-r82q-347r/GHSA-gmxc-r82q-347r.json"