Vulnerability details

CVE-2025-66449

C4illin ConvertX

ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution

CVSS 3.1

8.8High

Official description

ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.

CVSS scores

Score	Version	Source	Vector
8.8High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
C4illin	ConvertX	< 0.16.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e x_refsource_MISC
https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30 x_refsource_MISC
https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-12-16
Last updated: 2025-12-16
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.78%

Probability of exploitation in 30 days

56.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73
External Control of File Name or Path
CWE-434
Unrestricted Upload of File with Dangerous Type