High severity · published Dec 16, 2025
CVE-2025-66449
ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
ConvertX · C4illin
< 0.16.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66449
Product
https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30
Patch
https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e
Exploit
https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r
More from ConvertX
9.9
CVE-2026-105080
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre
8.1
CVE-2026-59976
ConvertX: Path Traversal vulnerability leading to Arbitrary File Write
8.1
CVE-2026-59977
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
8.1
CVE-2026-24741
ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`
6.5
CVE-2026-108694
ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter