CVE-2026-59976: ConvertX Path Traversal Vulnerability

CVE-2026-59976 Overview

CVE-2026-59976 is a path traversal vulnerability [CWE-22] in ConvertX, a self-hosted file conversion service. The flaw exists in the ImageMagick converter, which uses the unsanitized convert_to parameter to construct output file paths. An attacker who uploads an extensionless image and supplies directory traversal sequences through the /convert endpoint can escape the intended output directory. The attacker can then write converted output to arbitrary paths inside the container, potentially overwriting files or causing denial of service. The issue affects ConvertX versions prior to 0.18.0 and is fixed in 0.18.0.

Critical Impact
Authenticated users, or any user when unauthenticated access is enabled, can write files to arbitrary container paths through directory traversal in the conversion API.

Affected Products

ConvertX versions prior to 0.18.0
Deployments configured to allow unauthenticated access
Container deployments exposing the /convert endpoint

Discovery Timeline

2026-10-12 - CVE-2026-59976 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-59976

Vulnerability Analysis

The vulnerability resides in the ConvertX conversion pipeline, specifically in how the ImageMagick converter builds output paths. When a user submits a file through the /convert endpoint, the backend derives the output file name by combining the uploaded file name with the convert_to parameter. The server trusts convert_to without validating it for path separators or traversal sequences such as ../.

When a file is uploaded without an extension, the file name replacement logic appends the attacker-controlled convert_to value directly to the file name. This produces an output path that can escape the userOutputDir directory and target arbitrary container locations. The result is an arbitrary file write primitive restricted only to formats ImageMagick can produce.

Root Cause

The root cause is missing input sanitization on the convert_to request parameter in src/pages/convert.tsx, combined with naive filename handling in src/converters/main.ts. The code did not reject values containing /, \, or .., and the extension-replacement logic failed when the uploaded file had no extension, causing the full traversal payload to be appended to the output path.

Attack Vector

An authenticated user, or any user when ConvertX permits unauthenticated access, uploads an extensionless image and submits a convert_to value containing directory traversal sequences. The server constructs the output path using the attacker-controlled value and writes the converted file outside the intended output directory. This enables overwriting configuration files, writing to shared volumes, or disrupting application availability.

typescript

// Patch in src/pages/convert.tsx — reject traversal sequences in convert_to
const convertTo = normalizeFiletype(body.convert_to.split(",")[0] ?? "");
const converterName = body.convert_to.split(",")[1];

if (
  !converterName ||
  convertTo.includes("/") ||
  convertTo.includes("\\") ||
  convertTo.includes("..")
) {
  return redirect(`${WEBROOT}/`, 302);
}

Source: GitHub Commit 0965928

typescript

// Patch in src/converters/main.ts — safe handling of extensionless file names
const fileTypeOrig = fileName.includes(".") ? (fileName.split(".").pop() ?? "") : "";
const fileType = normalizeFiletype(fileTypeOrig);
const newFileExt = normalizeOutputFiletype(convertTo);
let newFileName: string;
if (fileTypeOrig === "") {
  newFileName = `${fileName}.${newFileExt}`;
} else {
  newFileName = fileName.replace(
    new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`),
    newFileExt,
  );
}
const targetPath = `${userOutputDir}${newFileName}`;

Source: GitHub Commit 0965928

Detection Methods for CVE-2026-59976

Indicators of Compromise

POST requests to /convert where the convert_to parameter contains ../, /, or \ sequences.
Files appearing in container directories outside the configured ConvertX output directory.
Unexpected overwrites of configuration files or application assets inside the ConvertX container.
Upload activity involving files without extensions followed by conversion requests.

Detection Strategies

Inspect ConvertX HTTP access logs for convert_to values containing path separators or traversal tokens.
Compare container filesystem state against a known-good baseline to identify unauthorized writes.
Alert on file creation events in sensitive container paths such as /app, /etc, and bind-mounted volumes.

Monitoring Recommendations

Enable application-level request logging that captures the full convert_to parameter value.
Forward container runtime file-write events to a central log store for correlation with web requests.
Monitor outbound process activity from the ConvertX container for signs of follow-on exploitation.

How to Mitigate CVE-2026-59976

Immediate Actions Required

Upgrade ConvertX to version 0.18.0 or later without delay.
Disable unauthenticated access until the upgrade is complete.
Audit the ConvertX container filesystem for files written outside the expected output directory.
Restrict network exposure of the /convert endpoint to trusted users only.

Patch Information

The vulnerability is fixed in ConvertX 0.18.0. The fix validates the convert_to parameter and rejects values containing /, \, or .., and corrects the output filename construction for extensionless uploads. See the GitHub Security Advisory GHSA-pvqw-vc5x-266j, Pull Request #532, and Release v0.18.0 for details.

Workarounds

Place ConvertX behind a reverse proxy that strips or rejects convert_to values containing path separators or .. sequences.
Run the ConvertX container with a read-only root filesystem and minimal writable volumes.
Require authentication and limit account provisioning to trusted operators.
Apply least-privilege container runtime options to reduce the impact of arbitrary file writes.

bash

# Example: upgrade ConvertX container to the patched release
docker pull ghcr.io/c4illin/convertx:0.18.0
docker stop convertx && docker rm convertx
docker run -d --name convertx \
  --read-only \
  --tmpfs /tmp \
  -v convertx-data:/app/data \
  -p 3000:3000 \
  ghcr.io/c4illin/convertx:0.18.0