CVE-2025-66449

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66449", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-01T18:22:06.865Z", "datePublished": "2025-12-16T00:10:49.204Z", "dateUpdated": "2025-12-16T15:08:56.145Z"}, "containers": {"cna": {"title": "ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r"}, {"name": "https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e", "tags": ["x_refsource_MISC"], "url": "https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e"}, {"name": "https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30", "tags": ["x_refsource_MISC"], "url": "https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30"}], "affected": [{"vendor": "C4illin", "product": "ConvertX", "versions": [{"version": "< 0.16.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-16T00:10:49.204Z"}, "descriptions": [{"lang": "en", "value": "ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-cpww-gwgc-p72r", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-16T14:36:29.538776Z", "id": "CVE-2025-66449", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T15:08:56.145Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66449", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T14:36:29.538776Z"}}}], "references": [{"url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-16T14:36:48.888Z"}}], "cna": {"title": "ConvertX has Path Traversal that leads to Arbitrary File Write and Arbitrary Code Execution", "source": {"advisory": "GHSA-cpww-gwgc-p72r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "C4illin", "product": "ConvertX", "versions": [{"status": "affected", "version": "< 0.16.0"}]}], "references": [{"url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "name": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e", "name": "https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30", "name": "https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-16T00:10:49.204Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66449", "state": "PUBLISHED", "dateUpdated": "2025-12-16T15:08:56.145Z", "dateReserved": "2025-12-01T18:22:06.865Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-16T00:10:49.204Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ConvertX", "vendor": "C4illin", "versions": [{"status": "affected", "version": "< 0.16.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:c4illin:convertx:*:*:*:*:*:*:*:*", "matchCriteriaId": "F67602C7-26D1-4477-AE93-85CE2AAE6A3D", "versionEndExcluding": "0.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue."}, {"lang": "es", "value": "ConvertX es un conversor de archivos en l\u00ednea autoalojado. En versiones anteriores a la 0.16.0, el endpoint '/upload' permite a un usuario autenticado escribir archivos arbitrarios en el sistema, sobrescribiendo binarios y permitiendo la ejecuci\u00f3n de c\u00f3digo. La funci\u00f3n de carga toma 'file.name' directamente de los datos proporcionados por el usuario sin realizar ninguna sanitizaci\u00f3n en el nombre, lo que permite la escritura arbitraria de archivos. Esto puede usarse para sobrescribir binarios del sistema con los proporcionados por un atacante, permitiendo la ejecuci\u00f3n completa de c\u00f3digo. La versi\u00f3n 0.16.0 contiene un parche para el problema."}], "id": "CVE-2025-66449", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66449", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-16T14:36:29.538776Z", "version": "2.0.3"}}]}, "published": "2025-12-16T01:15:51.750", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-12-16T20:45:27.115553+00:00", "updated": "2025-12-16T20:45:27.115579+00:00", "vendors": ["c4illin", "c4illin$PRODUCT$convertx"]}