CyberRota Analysis
AI-GeneratedConvertX 0.17.0 is vulnerable to an arbitrary file read issue in its xelatex converter, allowing authenticated users to exploit the system by uploading LaTeX files that contain specific input directives. This vulnerability enables attackers to access and read sensitive files on the server, which could lead to data exposure. Organizations using this version of ConvertX should prioritize patching or mitigating this vulnerability to protect against potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.