PT-2026-5023 · Convertx · Convertx

Siewer · Published 2026-01-27 · Updated 2026-02-12 · CVE-2026-24741

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.17.0

Description ConvertX is a self-hosted online file converter. The POST /delete endpoint uses a user-controlled filename value to construct a filesystem path and deletes it via the unlink function without sufficient validation. An attacker can supply path traversal sequences (e.g., ../) in the filename parameter to delete arbitrary files outside the intended uploads directory, limited by the permissions of the server process. The vulnerable parameter is filename.

Recommendations Update to version 0.17.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-24741

GHSA-W372-W6CR-45JP

Affected Products

Convertx

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24741.json · Exploit
• https://github.com/C4illin/ConvertX/security/advisories/GHSA-w372-w6cr-45jp · Vendor Advisory
• https://github.com/C4illin/ConvertX/commit/7a936bdc0463936463616381ca257b13babc5e77 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24741 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24741 · Vendor Advisory
• https://twitter.com/CVEnew/status/2016259856622387441 · Twitter Post
• https://t.me/cveNotify/151885 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016368888980635788 · Twitter Post