Arbitrary File Read Vulnerability in ConvertX by C4illin

CVE-2026-85618

What is CVE-2026-85618?

The ConvertX 0.17.0 contains a significant vulnerability in its xelatex converter, allowing authenticated users to exploit arbitrary file reading capabilities. By uploading LaTeX files that include \input{path} or \verbatiminput{path} directives, attackers can leverage the TeX engine to access sensitive server files which can then be included in the generated PDF output. This flaw poses a risk as it could lead to unauthorized information disclosure, potentially exposing sensitive data stored on the server.

References