Description

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T20:17:50.143Z",
  "pubdate": "2026-08-27T20:17:50.143Z",
  "executiveSummary": "The Node.js module libreoffice-convert, in versions prior to 1.8.2, is vulnerable to an arbitrary file write vulnerability caused by improper input validation.\nThe vulnerability originates from the application's failure to sanitize user-controlled input used in file system operations. Specifically, the fileName option is passed directly to the path.join function without being restricted to a base filename.\nAn unauthenticated attacker can exploit this flaw by providing a crafted fileName parameter containing directory traversal sequences (../). This allows the attacker to escape the designated temporary directory and write arbitrary document buffers to sensitive locations within the host file system.\nSuccessful exploitation can result in full system compromise, remote code execution (RCE), or persistence. Potential targets include SSH authorized_keys files, cron job configurations, or web server root directories. This represents a critical risk to any infrastructure relying on this library for document conversion, as the application process inherits the permissions necessary to overwrite critical configuration files.",
  "technicalDetails": "The vulnerability is rooted in the index.js component of the libreoffice-convert library. The library accepts a caller-controlled options object, specifically the fileName property, which is utilized to determine the destination path for the converted document buffer.\nThe root cause is the lack of normalization or sanitization before the fileName variable is concatenated with the temporary directory path via path.join(tempDir.name, fileName). Because path.basename() is not applied to the user input, the logic fails to enforce boundary constraints on the target destination.\nThe attack flow begins when an attacker invokes the conversion function and provides a malicious string as the fileName option. An example payload such as '../../../../home/user/.ssh/authorized_keys' can be used to traverse out of the sandbox environment. When the library proceeds to write the document buffer to the destination, the path.join operation resolves the traversal, mapping the file write operation to the attacker-defined target path.\nSince the write operation occurs with the privileges of the Node.js process, any path writable by that process is subject to manipulation. If the process runs with elevated privileges or has write access to system-critical directories, the attacker can overwrite sensitive configuration files. By injecting an SSH public key into the authorized_keys file, an attacker can gain persistent remote shell access. Alternatively, overwriting a cron configuration allows the execution of arbitrary commands, or overwriting files in the web root may facilitate the injection of malicious web scripts, leading to remote code execution.\nThis vulnerability affects all versions of libreoffice-convert prior to 1.8.2. No authentication is required to trigger the path traversal if the conversion functionality is exposed via an API or user-facing interface. The primary requirement for exploitation is that the attacker must be able to supply the fileName parameter and that the Node.js process has write permissions on the target location. Post-exploitation impact is limited only by the permissions of the service account executing the library."
}