Description
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| C4illin | ConvertX | ≤ 0.19.0 | — |
References
- GitHub Issue #668 issue-tracking
- https://github.com/C4illin/ConvertX product
- https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152 technical-description
- VulnCheck Advisory: ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter third-party-advisory