{"id":"CVE-2026-54732","title":"libreoffice-convert is a Node.js module for converting office documents to different formats","summary":"libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base n…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-22"],"vendor":"libreoffice-convert","product":"libreoffice-convert","affected":["libreoffice-convert < 1.8.2"],"patched":["libreoffice-convert 1.8.2"],"published":"2026-08-27","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54732","references":[{"url":"https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b","label":"security-advisories@github.com"},{"url":"https://github.com/elwerene/libreoffice-convert/security/advisories/GHSA-gmxc-r82q-347r","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-gmxc-r82q-347r"}],"tags":["nvd","ghsa","npm"],"epss":0.003,"epssPercentile":0.22961,"aliases":["GHSA-gmxc-r82q-347r"],"ecosystem":"npm","ingestedAt":"2026-08-27T18:06:13.162Z","slug":"CVE-2026-54732","body":"## Overview\n\nlibreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54732)\n\nAffected packages:\n\n- `libreoffice-convert < 1.8.2`\n\nPatched in:\n\n- `libreoffice-convert 1.8.2`\n\nSource: https://github.com/advisories/GHSA-gmxc-r82q-347r","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}