CVE-2026-59977: high-severity vulnerability in C4illin ConvertX
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.1%
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected products
C4illin · ConvertXRelated CVEs — C4illin ConvertX
In the same product, most dangerous first.
CVE-2025-66449HIGHConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code ExecutionEPSS 0.8%CVE-2026-59976HIGHConvertX: Path Traversal vulnerability leading to Arbitrary File WriteEPSS 0.8%CVE-2026-85618HIGHConvertX 0.17.0 Arbitrary File Read via LaTeX Input DirectivesEPSS 0.5%CVE-2026-24741HIGHConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete`EPSS 0.5%CVE-2026-105080CRITICALCVE-2026-105080EPSS 0.4%CVE-2026-108694HIGHConvertX through 0.19.0 Arbitrary File Read via Pandoc ConverterEPSS 0.3%