Cross-Site Request Forgery Vulnerability in ConvertX File Conversion Service
CVE-2026-59977

8.1HIGH

Key Information:

Vendor

C4illin

Status
Convertx
Vendor
CVE Published:
12 October 2026

What is CVE-2026-59977?

The ConvertX file conversion service had a vulnerability in the /delete/{id} endpoint prior to version 0.18.0. This flaw allowed for permanent deletion of user jobs without proper CSRF protection. An authenticated user could inadvertently trigger this by visiting a malicious link that invoked the deletion endpoint, resulting in unauthorized loss of converted-file history. It is strongly recommended that users upgrade to version 0.18.0 or later to safeguard their file conversion processes.

Affected Version(s)

ConvertX < 0.18.0

References

https://github.com/C4illin/ConvertX/security/advisories/G...
x_refsource_CONFIRM
https://github.com/C4illin/ConvertX/commit/e1253267208e43...
x_refsource_MISC
https://github.com/C4illin/ConvertX/releases/tag/v0.18.0
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.