CVE-2026-54732: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in elwerene libreoffice-convert

The vulnerability in libreoffice-convert arises from improper limitation of a pathname to a restricted directory (CWE-22). Specifically, prior to version 1.8.2, the module uses the caller-controlled options.fileName value directly in path.join(tempDir.name, fileName) without applying path.basename() normalization. This omission allows filenames containing '../' sequences to traverse directories and write files outside the intended temporary directory. An attacker can exploit this to write arbitrary files to locations writable by the process, including critical system or application files. The vulnerability is addressed in version 1.8.2 by properly normalizing the filename input.

An attacker with the ability to control the fileName parameter can write arbitrary files to any location writable by the process running libreoffice-convert. This can lead to unauthorized modification of sensitive files such as SSH authorized_keys, cron jobs, or web server files, potentially enabling privilege escalation, persistent access, or web-based attacks. The CVSS score of 6.5 (medium severity) reflects the network attack vector, low attack complexity, requirement for privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

This vulnerability is fixed in libreoffice-convert version 1.8.2. Users should upgrade to version 1.8.2 or later to mitigate this issue. No other mitigation is indicated by the vendor advisory or source information.