CVE-2026-59976: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in C4illin ConvertX

ConvertX versions prior to 0.18.0 contain a path traversal vulnerability (CWE-22) in the ImageMagick converter. The 'convert_to' parameter is not properly sanitized, allowing attackers to escape the designated output directory by including directory traversal sequences in the parameter. This enables writing converted files to arbitrary paths within the container, potentially overwriting critical files or causing denial of service. The vulnerability requires at least authenticated access unless unauthenticated access is enabled. The vulnerability is addressed in version 0.18.0.

Exploitation allows an attacker to write files outside the intended output directory, potentially overwriting important files or causing denial of service conditions. This can impact the integrity and availability of the system running ConvertX. Confidentiality is not directly affected according to the CVSS vector.

Upgrade ConvertX to version 0.18.0 or later, where this vulnerability is fixed. No other mitigations are indicated or required by the vendor advisory.