Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108694ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

Medium 6.5

In plain English

A medium-severity security flaw in ConvertX from C4illin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.

Affected products (as reported)

Vendor	Product	Versions
C4illin	ConvertX	0 – through 0.19.0

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #668 issue-tracking
https://github.com/C4illin/ConvertX product
https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152 technical-description
VulnCheck Advisory: ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter third-party-advisory