CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability (CWE-22) in its xelatex converter that lets authenticated users read arbitrary files on the server. An attacker with valid credentials uploads a .tex file containing \input{path} or \verbatiminput{path} directives, causing the TeX engine to resolve the given path and embed the target file's contents into the generated PDF, which the attacker then downloads. Successful exploitation grants read access to any file accessible to the server process — potentially including configuration files or stored credentials — but does not affect integrity or availability (CVSS 4.0 7.1, high confidentiality impact only). Any deployment running ConvertX 0.17.0 with the xelatex conversion path enabled and accessible to logged-in users is affected, with internet-exposed self-hosted instances facing the greatest risk. Exploitation is not currently observed: there is no known public proof-of-concept, EPSS estimates only a 0.4% probability of exploitation within 30 days, and the issue is not in CISA's KEV catalog.

What to do: Restrict the xelatex/TeX converter to trusted authenticated users, or disable TeX-based conversions until a patched release is available (no fixed version is named in the available data, so monitor the project's repository for an update). Ensure strong authentication on internet-exposed ConvertX instances since exploitation requires valid credentials, and treat files readable by the ConvertX server process (e.g., its configuration or environment files) as potentially disclosed if untrusted users had upload access.