Emrik Östling

2 exploits Active since Dec 2025
CVE-2025-66449 WRITEUP HIGH WRITEUP
ConvertX < 0.16.0 - Authenticated Arbitrary File Write via Upload Endpoint
ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.
CVSS 8.8
CVE-2026-24741 WRITEUP HIGH WRITEUP
ConvertX < 0.17.0 - Path Traversal and Arbitrary File Deletion via Delete Endpoint
ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a filesystem path and deletes it via `unlink` without sufficient validation. By supplying path traversal sequences (e.g., `../`), an attacker can delete arbitrary files outside the intended uploads directory, limited only by the permissions of the server process. Version 0.17.0 fixes the issue.
CVSS 8.1