PT-2025-51348 · Convertx · Convertx

Published 2025-12-16 · Updated 2025-12-21 · CVE-2025-66449

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.16.0

Description ConvertX is a self-hosted online file converter. The /upload endpoint allows an authenticated user to write arbitrary files on the system, potentially overwriting binaries and enabling code execution. The file.name parameter, received from user input, lacks proper sanitization, allowing for arbitrary file write. This could allow an attacker to overwrite system binaries with malicious files, leading to full code execution.

Recommendations Update to version 0.16.0.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-73

CWE-434

CWE-22

Related Identifiers

CVE-2025-66449

GHSA-CPWW-GWGC-P72R

Affected Products

Convertx

References · 11

• 🔥 https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66449.json · Exploit
• https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66449 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66449 · Vendor Advisory
• https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30 · Note
• https://twitter.com/CveFindCom/status/2000742542950711331 · Twitter Post
• https://t.me/CVEtracker/39896 · Telegram Post
• https://t.me/cveNotify/145884 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000853295665918140 · Twitter Post
• https://twitter.com/CVEnew/status/2002836009143108045 · Twitter Post