CVE-2026-108694

EUVD-2026-96697
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.33%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
c4illinconvertx
𝑥
≤ 0.19.0
CNA
Common Weakness Enumeration
References
https://github.com/C4illin/ConvertX
https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152
https://github.com/C4illin/ConvertX/issues/668
https://www.vulncheck.com/advisories/convertx-through-0.19.0-arbitrary-file-read-via-pandoc-converter