Path Traversal Vulnerability in ConvertX File Converter Software by C4illin

CVE-2026-24741

What is CVE-2026-24741?

ConvertX, a self-hosted online file converter, has a vulnerability that allows an attacker to exploit the POST /delete endpoint. In versions prior to 0.17.0, user-controlled filename values were improperly used to create filesystem paths, allowing for arbitrary file deletions outside of the designated upload directory. By leveraging path traversal sequences, attackers can manipulate the server to delete sensitive files based on the application's permission settings. Version 0.17.0 resolves this issue by implementing necessary validations.

References