The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
"https://github.com/pypa/advisory-database/blob/main/vulns/unoconv/PYSEC-2019-213.yaml"