Path Traversal Vulnerability in ConvertX File Converter Software by C4illin

CVE-2026-24741

What is CVE-2026-24741?

ConvertX, a self-hosted online file converter, has a vulnerability that allows an attacker to exploit the POST /delete endpoint. In versions prior to 0.17.0, user-controlled filename values were improperly used to create filesystem paths, allowing for arbitrary file deletions outside of the designated upload directory. By leveraging path traversal sequences, attackers can manipulate the server to delete sensitive files based on the application's permission settings. Version 0.17.0 resolves this issue by implementing necessary validations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References