{"id":"CVE-2026-108694","revision":"8a1d99915e68439bade594e32f604c36","records":[{"revision":"8a1d99915e68439bade594e32f604c36","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-108694","aliases":[],"title":"ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter","description":"ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path, convert it, and download output containing the referenced file's contents.","state":0,"publishedAt":"2026-10-11T01:35:44.264+00:00","modifiedAt":"2026-10-18T11:53:07.284+00:00","affected":[{"ecosystem":"Vendor product","name":"ConvertX","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"C4illin\",\n                    \"product\": \"ConvertX\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://github.com/C4illin/ConvertX\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"0.19.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/C4illin/ConvertX/issues/668","https://github.com/C4illin/ConvertX","https://github.com/C4illin/ConvertX/blob/710bc7c71712af04198a39f003e3ea1aa5168a31/src/converters/pandoc.ts#L123-L152","https://www.vulncheck.com/advisories/convertx-through-0.19.0-arbitrary-file-read-via-pandoc-converter"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108694","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-108694","identifiers":["CVE-2026-108694"]},"retained":false,"historicalAffected":[]}],"coverage":[]}