---
id: CVE-2026-85618
title: >-
  ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex
  converter that allows authenticated users to read files by uploading LaTeX
  files with input directives
summary: >-
  ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex
  converter that allows authenticated users to read files by uploading LaTeX
  files with input directives. Attackers can upload .tex files containing
  \\input{path}…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: C4illin
product: ConvertX
affected:
  - ConvertX <= 0.18.0
published: '2026-09-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:18:00.063'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85618'
references:
  - url: 'https://github.com/C4illin/ConvertX'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/C4illin/ConvertX/blob/v0.18.0/src/converters/xelatex.ts'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/C4illin/ConvertX/issues/573'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/convertx-0.17.0-arbitrary-file-read-via-latex-input-directives
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T14:19:20.549099Z'
epss: 0.00376
epssPercentile: 0.31483
ingestedAt: '2026-09-10T15:53:17.107Z'
---

## Overview

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \\input{path} or \\verbatiminput{path} directives to have the TeX engine read arbitrary files accessible to the server process and include them in downloadable PDF output.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.