Description

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:41.857Z",
  "pubdate": "2026-09-04T15:17:41.857Z",
  "executiveSummary": "The ConvertX application, specifically version 0.17.0, is susceptible to an arbitrary file read vulnerability residing within its xelatex document conversion process.\nThis vulnerability is classified as an Improper Input Validation issue, where the TeX processing engine fails to restrict file access directives within user-supplied LaTeX files.\nAn authenticated attacker can leverage this flaw to exfiltrate sensitive files from the underlying server filesystem by embedding malicious directives such as \\input or \\verbatiminput into a document for conversion.\nThe successful exploitation of this vulnerability results in the unauthorized disclosure of sensitive server-side data, including configuration files, source code, or system credentials, depending on the server process permissions.\nThe risk profile is significant as it allows attackers with authenticated access to bypass logical file boundaries, potentially leading to full system compromise or further privilege escalation.\nThe requirement for authentication limits the initial attack vector, yet does not mitigate the severity of the potential information disclosure once the attacker gains access to the conversion utility.",
  "technicalDetails": "The vulnerability originates in the xelatex converter component of ConvertX 0.17.0, which processes user-provided .tex files without adequate sanitization or sandboxing of the TeX engine environment.\nThe root cause of this vulnerability is the failure to disable TeX macro commands that interact with the local filesystem, specifically the \\input and \\verbatiminput primitives. In a standard TeX installation, these commands are designed to include external content into the rendered document, which is an intended feature; however, when exposed to unprivileged user input in a server-side context, this functionality becomes a security primitive for unauthorized file access.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious .tex file containing directives pointing to sensitive paths, such as \\input{/etc/passwd} or \\verbatiminput{/home/app/config.json}. Second, the attacker uploads this crafted file to the ConvertX interface. Third, the application passes the file to the backend xelatex engine for PDF generation. Fourth, the TeX engine executes the embedded file system directive during the compilation phase, reading the target file contents into the document buffer. Finally, the server generates a PDF containing the contents of the targeted file, which is then made available for the attacker to download.\nBecause the server process executes the conversion, the TeX engine operates with the privileges assigned to the application service account. This allows the attacker to read any file reachable by the service user. The lack of an isolated environment, such as a chroot jail or containerized sandbox with restricted filesystem mounts, allows the TeX process to traverse the directory tree and access sensitive system files outside of the application's intended scope.\nPost-exploitation impact involves the exfiltration of environment variables, database credentials, API keys, and sensitive application source code, providing the attacker with sufficient information to conduct further lateral movement or complete system take-over."
}