CVE-2026-59977: ConvertX CSRF Vulnerability

CVE-2026-59977 Overview

ConvertX is a self-hosted file conversion service. Versions prior to 0.18.0 contain a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the /delete/{id} endpoint. The endpoint uses HTTP GET for permanent deletion operations and lacks CSRF protection. An authenticated user who visits attacker-controlled content triggering a request to /delete/{id} will have their browser automatically send the session cookie. The request then deletes the targeted job without consent, resulting in unauthorized loss of converted-file history. The maintainers fixed the issue in version 0.18.0 by switching the endpoint to HTTP POST.

Critical Impact
Attackers can silently delete any authenticated user's conversion job history by luring the user to visit a crafted web page, resulting in unauthorized data loss.

Affected Products

ConvertX self-hosted file conversion service
All versions prior to 0.18.0
Deployments exposing authenticated user sessions in browsers

Discovery Timeline

2026-10-12 - CVE-2026-59977 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-59977

Vulnerability Analysis

The vulnerability stems from two combined design flaws in the ConvertX deleteJob route. First, the endpoint uses HTTP GET for a state-changing operation. Second, the application does not validate a CSRF token or verify request origin. Browsers automatically follow GET requests embedded in <img>, <script>, or <a> tags and attach session cookies for the target origin. An attacker-controlled page that references https://convertx.example/delete/123 therefore triggers deletion using the victim's authenticated session.

The weakness maps to CWE-352 (Cross-Site Request Forgery). Exploitation requires that the victim is authenticated to a vulnerable ConvertX instance and visits attacker-controlled content. No credential theft or elevated privileges are required.

Root Cause

The deleteJob handler in src/pages/deleteJob.tsx registered the delete action with .get("/delete/:jobId", ...). HTTP GET requests are expected to be idempotent and safe. Using GET for destructive actions exposes the endpoint to CSRF because browsers follow GET links without user interaction. The absence of an anti-CSRF token or SameSite enforcement completed the exploitable chain.

Attack Vector

An attacker crafts a web page or email containing a tag that references the vulnerable deletion URL, for example an <img> element whose src points at /delete/{jobId}. When an authenticated ConvertX user loads the content, the browser issues the GET request with session cookies attached. The server authorizes the request and deletes the specified job. The attack requires user interaction (UI:R) but no attacker authentication (PR:N).

text

// Patch excerpt - src/pages/deleteJob.tsx
export const deleteJob = new Elysia()
  .use(userService)
  // SECURE: Use POST instead of GET for state-changing actions to prevent CSRF.
  // Browsers automatically follow GET links, which can lead to silent data deletion.
  .post(
    "/delete/:jobId",
    async ({ params, redirect, user }) => {
      const job = db

Source: GitHub Commit e125326

Detection Methods for CVE-2026-59977

Indicators of Compromise

Unexpected GET requests to /delete/{jobId} in ConvertX access logs that originate from external Referer headers.
Conversion job entries disappearing from user histories without corresponding user-initiated delete actions.
Access log entries where the User-Agent and Referer indicate a browser navigation from an unrelated third-party domain.

Detection Strategies

Review ConvertX reverse-proxy or application logs for GET requests to /delete/:jobId paired with cross-origin Referer or Origin headers.
Correlate deletion events in the ConvertX database with authenticated session activity to identify deletions occurring outside interactive sessions.
Deploy a web application firewall rule that flags GET requests to deletion endpoints on versions prior to 0.18.0.

Monitoring Recommendations

Enable verbose HTTP request logging on the ConvertX host and forward logs to a centralized analytics platform.
Alert on spikes in /delete/* traffic volume or deletions sourced from a single external referrer.
Monitor browser session telemetry for authenticated users loading external content shortly before unexpected deletions.

How to Mitigate CVE-2026-59977

Immediate Actions Required

Upgrade all ConvertX deployments to version 0.18.0 or later without delay.
Terminate active ConvertX sessions and require re-authentication after upgrading.
Audit conversion job history for unauthorized deletions and restore from backups where possible.

Patch Information

The fix is included in ConvertX v0.18.0. The maintainers changed the deleteJob route from .get to .post, preventing browsers from issuing the destructive request through passive HTML elements. Review the full patch in GitHub Commit e125326 and the GitHub Security Advisory GHSA-63w7-h5q8-hcrj.

Workarounds

Place ConvertX behind a reverse proxy that rejects GET requests to /delete/* paths until the upgrade is complete.
Configure session cookies with SameSite=Strict to prevent cross-site request inclusion of session cookies.
Restrict ConvertX access to trusted networks or require VPN connectivity to reduce exposure to attacker-controlled content.

bash

# Example NGINX rule blocking GET deletions pre-upgrade
location ~ ^/delete/ {
    if ($request_method = GET) {
        return 405;
    }
    proxy_pass http://convertx_backend;
}