Path Traversal Vulnerability in p2r3 Convert API by Vendor
CVE-2026-6636

5.3MEDIUM

Key Information:

Vendor

P2r3

Status
Convert
Vendor
CVE Published:
20 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-6636?

A path traversal vulnerability has been identified in the p2r3 Convert API, specifically within the Bun.serve function of the buildCache.js file. This vulnerability is triggered by manipulating the pathname argument, allowing attackers to exploit the system remotely. The exploit has been made public, posing a potential risk to users of the affected versions. The vendor was notified of the issue but has not yet issued any response or corrective measures.

Affected Version(s)

convert 6998584ace3e11db66dff0b423612a5cf91de75b

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-6636 - Proof of Concept

References

https://vuldb.com/vuln/358270
vdb-entrytechnical-description
https://vuldb.com/vuln/358270/cti
signaturepermissions-required
https://vuldb.com/submit/793436
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

davidgilmore (VulDB User)
VulDB CNA Team
.