CVE-2026-59977: CWE-352: Cross-Site Request Forgery (CSRF) in C4illin ConvertX

ConvertX versions before 0.18.0 expose a CSRF vulnerability on the /delete/{id} HTTP GET endpoint. This endpoint allows permanent deletion of conversion jobs without requiring CSRF tokens or other protections. Because the endpoint uses GET and lacks CSRF defenses, an attacker can craft a malicious webpage that triggers the deletion when visited by an authenticated user, leveraging the user's session cookie. This leads to unauthorized deletion of converted-file history. The vulnerability is addressed by fixing the endpoint in version 0.18.0.

Exploitation allows an attacker to cause an authenticated user to unknowingly delete conversion jobs permanently, resulting in loss of converted-file history. The vulnerability does not impact confidentiality but has high integrity and availability impact by enabling unauthorized deletion of data.

Upgrade ConvertX to version 0.18.0 or later, where the /delete/{id} endpoint has been fixed to prevent CSRF attacks. No other mitigation is required as the issue is resolved in this official fix.