CVE-2026-108694 HIGH

CVE-2026-108694: ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

Vendor C4Illin

Product ConvertX

Weakness CWE-73

Published October 11, 2026

Last update October 11, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.

Key dates

02Disclosure timeline

October 11, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-108694 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html AskarLabs — CWE-73 write-up External Control of File Name or Path

Related vulnerabilities

04Related CVE

CVE-2024-12066 SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-11738 Media Library Assistant <= 3.29 - Unauthenticated Limited File Read CVE-2022-0246 iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip CVE-2025-3103 CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read CVE-2025-13320 WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter