CVE-2026-108694: ConvertX Information Disclosure Vulnerability

CVE-2026-108694 Overview

CVE-2026-108694 is an arbitrary file read vulnerability affecting ConvertX through version 0.19.0. The flaw resides in src/converters/pandoc.ts, which invokes Pandoc without the --sandbox flag. Authenticated attackers can upload a reStructuredText (reST) document containing an include directive that references an absolute path on the server. When ConvertX processes the file, Pandoc reads the referenced file and embeds its contents into the converted output, which the attacker then downloads. The weakness is classified under [CWE-73: External Control of File Name or Path].

Critical Impact
Authenticated users can read arbitrary files accessible to the ConvertX service account, including configuration files, credentials, and application secrets.

Affected Products

ConvertX through version 0.19.0
Deployments using the vulnerable src/converters/pandoc.ts converter path
Self-hosted ConvertX instances exposed to multiple users

Discovery Timeline

2026-10-11 - CVE-2026-108694 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108694

Vulnerability Analysis

ConvertX is a self-hosted file conversion service that wraps multiple converters, including Pandoc, behind an authenticated web interface. The vulnerable converter module invokes Pandoc as a subprocess to transform user-uploaded documents between formats.

Pandoc parses reStructuredText include directives by default. These directives instruct the parser to read a file from disk and embed its contents into the output document. Pandoc provides a --sandbox flag that restricts filesystem access for exactly this scenario, but ConvertX does not pass it. See the vulnerable converter source for the invocation path.

An authenticated attacker uploads a crafted .rst file referencing absolute paths such as /etc/passwd, /proc/self/environ, or application configuration files. After conversion, the resulting output (for example HTML, PDF, or DOCX) contains the file contents, which the attacker retrieves through the normal download flow.

Root Cause

The root cause is a missing security control in the Pandoc invocation. The converter trusts user-supplied document content and omits the --sandbox option, leaving Pandoc's default file-inclusion behavior enabled. Input sanitization at the application layer is also absent, so include directives are not stripped prior to conversion.

Attack Vector

Exploitation requires network access to the ConvertX web interface and a valid user account. The attacker uploads a reST document containing an include directive pointing to a target file, selects a supported output format, and downloads the converted file to retrieve the contents. No elevated privileges or user interaction are required beyond standard authenticated workflow usage.

Technical details and reproduction steps are documented in the VulnCheck advisory and GitHub issue #668.

Detection Methods for CVE-2026-108694

Indicators of Compromise

Uploaded files with .rst extensions containing .. include:: directives referencing absolute paths such as /etc/, /root/, /var/, or application config directories
Pandoc process invocations spawned by ConvertX without the --sandbox argument in process audit logs
Converted output files whose size or content substantially exceeds the uploaded source document
Access attempts targeting sensitive files like /etc/passwd, /etc/shadow, SSH keys, or .env files from the ConvertX service account

Detection Strategies

Inspect uploaded documents for reStructuredText include, raw, or literalinclude directives before conversion
Monitor the ConvertX service account for file reads outside its working directory and upload storage path
Correlate upload events, Pandoc process execution, and subsequent downloads from the same session for unusual output sizes

Monitoring Recommendations

Enable process auditing (auditd, Sysmon for Linux) on the host running ConvertX and alert on Pandoc executions missing --sandbox
Forward ConvertX application logs and container stdout to a centralized log platform for review of upload and conversion activity
Baseline normal user behavior to flag accounts generating repeated conversions with absolute-path content references

How to Mitigate CVE-2026-108694

Immediate Actions Required

Restrict access to the ConvertX instance to trusted users and place it behind a VPN or reverse proxy with authentication
Rotate any credentials, API keys, or secrets stored in files readable by the ConvertX service account
Review conversion history and application logs for suspicious .rst uploads referencing sensitive paths
Run ConvertX as a dedicated low-privilege user with filesystem access limited to its working directories

Patch Information

At the time of publication, the upstream fix should be tracked through the ConvertX GitHub repository and issue #668. The remediation requires passing the --sandbox flag to Pandoc invocations in src/converters/pandoc.ts or filtering disallowed directives from user input before conversion.

Workarounds

Disable the Pandoc converter in ConvertX until a patched release is deployed
Run ConvertX inside a container with a read-only root filesystem and no bind mounts exposing host files or secrets
Apply mandatory access controls (AppArmor, SELinux) to confine the ConvertX process and Pandoc subprocess to the upload directory
Pre-process uploaded reStructuredText files to strip include, raw, and literalinclude directives before passing them to the converter

bash

# Example: run ConvertX in a hardened container with no host filesystem exposure
docker run -d \
  --name convertx \
  --read-only \
  --tmpfs /tmp \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  -v convertx-data:/app/data \
  -p 127.0.0.1:3000:3000 \
  ghcr.io/c4illin/convertx:latest