PT-2026-5023 · Convertx · Convertx

Siewer · Publicado 2026-01-27 · Atualizado 2026-02-12 · CVE-2026-24741

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.17.0

Description ConvertX is a self-hosted online file converter. The POST /delete endpoint uses a user-controlled filename value to construct a filesystem path and deletes it via the unlink function without sufficient validation. An attacker can supply path traversal sequences (e.g., ../) in the filename parameter to delete arbitrary files outside the intended uploads directory, limited by the permissions of the server process. The vulnerable parameter is filename.

Recommendations Update to version 0.17.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-24741

GHSA-W372-W6CR-45JP

Produtos afetados

Convertx

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24741.json · Exploit
• https://github.com/C4illin/ConvertX/security/advisories/GHSA-w372-w6cr-45jp · Aviso do Fabricante
• https://github.com/C4illin/ConvertX/commit/7a936bdc0463936463616381ca257b13babc5e77 · Correção
• https://twitter.com/CVEnew/status/2016259856622387441 · Publicação no Twitter
• https://t.me/cveNotify/151885 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2016368888980635788 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24741 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24741 · Aviso do Fabricante