CVE-2026-85618CWE-22path-traversal

CVE-2026-85618

Medium · published September 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-04T19:17Z
References (4)
https://github.com/C4illin/ConvertX · [email protected]https://github.com/C4illin/ConvertX/blob/v0.18.0/src/converters/xelatex.ts · [email protected]https://github.com/C4illin/ConvertX/issues/573 · [email protected]https://www.vulncheck.com/advisories/convertx-0.17.0-arbitrary-file-read-via-latex-input-directives · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 14:32Z
    ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
    cvelistv5