CVE-2026-85618: ConvertX Path Traversal Vulnerability

CVE-2026-85618 Overview

CVE-2026-85618 is an arbitrary file read vulnerability in ConvertX 0.17.0, an open-source self-hosted file conversion service. The flaw resides in the xelatex converter component, which processes user-supplied LaTeX documents without sanitizing input directives. Authenticated users can upload .tex files containing \input{path} or \verbatiminput{path} directives to force the TeX engine to read arbitrary files accessible to the server process. The included content is then embedded into the resulting PDF output, which the attacker can download. The issue is tracked as CWE-22 path traversal and is documented in the VulnCheck Advisory for ConvertX.

Critical Impact
Authenticated attackers can exfiltrate any file readable by the ConvertX server process, including configuration files, credentials, and secrets stored on the host.

Affected Products

ConvertX version 0.17.0
ConvertX deployments using the xelatex converter
Self-hosted ConvertX instances processing untrusted user uploads

Discovery Timeline

2026-09-04 - CVE-2026-85618 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85618

Vulnerability Analysis

ConvertX exposes a document conversion pipeline that hands uploaded LaTeX sources to the xelatex engine for PDF compilation. The xelatex.ts converter, referenced in the GitHub ConvertX xelatex Converter source, invokes the TeX engine without restricting file inclusion primitives. LaTeX natively supports the \input and \verbatiminput commands, which read external files during compilation. When an attacker supplies these directives with absolute or relative paths, the TeX engine resolves them under the ConvertX service account's permissions. The compiler embeds the target file contents in the generated PDF, which is then returned to the requester through the standard download flow.

Root Cause

The root cause is the absence of input filtering and TeX engine sandboxing in the conversion pipeline. xelatex runs by default with unrestricted file access unless the operator explicitly configures openin_any = p or invokes the engine with -no-shell-escape and restricted openin policies. ConvertX invokes xelatex without these restrictions, so LaTeX file inclusion primitives operate against the host filesystem. See GitHub Issue #573 for maintainer discussion.

Attack Vector

An authenticated user submits a crafted .tex file through the standard upload endpoint. The document body contains a directive such as \input{/etc/passwd} or \verbatiminput{/app/config/.env} targeting a file readable by the ConvertX process. After conversion completes, the attacker downloads the resulting PDF and extracts the embedded file contents. No memory corruption, network callbacks, or elevated privileges are required beyond an authenticated session.

No verified proof-of-concept code is included here. Refer to the VulnCheck Advisory for ConvertX for a technical walkthrough of the exploitation flow.

Detection Methods for CVE-2026-85618

Indicators of Compromise

Uploaded .tex files containing \input{}, \include{}, or \verbatiminput{} directives referencing paths outside the working directory.
ConvertX process file access events targeting sensitive paths such as /etc/passwd, /proc/self/environ, or application secret directories.
Anomalously large or text-heavy PDF outputs generated from short LaTeX source files.

Detection Strategies

Inspect submitted LaTeX source for file inclusion commands prior to compilation and log any match for review.
Correlate ConvertX audit logs of conversion jobs against filesystem access telemetry from the host to identify reads outside the job workspace.
Monitor the xelatex child process for openat and open syscalls resolving outside the temporary conversion directory.

Monitoring Recommendations

Enable verbose logging on the ConvertX xelatex converter to record submitted document metadata and compiler stdout for post-incident review.
Forward host process telemetry from the ConvertX server into a centralized analytics platform to baseline normal converter file access patterns.
Alert on repeated failed conversions from a single authenticated account, which may indicate path discovery attempts.

How to Mitigate CVE-2026-85618

Immediate Actions Required

Upgrade ConvertX to version 0.18.0 or later, which addresses the xelatex converter as tracked in GitHub Issue #573.
Restrict ConvertX account registration and audit existing accounts to limit exposure to authenticated attackers.
Run the ConvertX service under a dedicated low-privilege user with no read access to secrets, configuration, or credential stores.

Patch Information

Maintainers addressed the issue in the ConvertX repository. Review the fix in the GitHub ConvertX Repository and the updated converter logic in the GitHub ConvertX xelatex Converter. Operators should redeploy from the fixed tag and rotate any secrets that were readable by the previous service account.

Workarounds

Disable the xelatex converter in the ConvertX configuration if PDF generation from LaTeX is not required.
Configure the TeX distribution with openin_any = p in texmf.cnf to block absolute-path file reads by the compiler.
Execute xelatex inside a filesystem sandbox or container mount namespace that only exposes the per-job working directory.
Apply upload filtering to reject .tex submissions containing \input, \include, \verbatiminput, or \InputIfFileExists directives with non-relative paths.

bash

# Configuration example: restrict TeX file inclusion at the engine level
# /etc/texmf/texmf.cnf or user texmf.cnf
openin_any = p    # only permit reads within the current working directory
openout_any = p   # only permit writes within the current working directory
shell_escape = f  # disable shell escape execution