CVE-2026-59976: ConvertX < 0.18.0

Affected technology

ConvertX · < 0.18.0
C4illin

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says if an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an extensionless image and supplies directory traversal sequences in convert_to through /convert, the constructed path escapes the intended output directory, allowing the attacker to write converted output to arbitrary container paths, potentially overwriting files or causing denial of service. Vendor/CNA’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality impact as none; integrity and availability impact as high.