Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unlink` without sufficient validation. By supplying path traversal sequences (e.g., `../`), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-24741 Path Traversal in ConvertXis File Deletion Endpoint Before 0.17.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24741
Post summary
The text announces a Path Traversal vulnerability (CVE-2026-24741) affecting ConvertXis File Deletion Endpoint versions prior to 0.17.0.
CVE-2026-24741 ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesy… https://www.cve.org/CVERecord?id=CVE-2026-24741
Post summary
The text discloses that CVE-2026-24741 affects ConvertX versions before 0.17.0, where the delete endpoint can use a user‑controlled filename to construct a filesystem path, enabling potential arbitrary file manipulation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | c4illin | convertx | - | - | - |