ConvertX versions up to 0.19.0 can be exploited by an authenticated user to read arbitrary files on the server. The vulnerability occurs because the pandoc converter is called without enabling Pandoc’s sandbox mode. An attacker can upload a reStructuredText file that contains an include directive pointing to an absolute file path; when the file is converted, the output is returned to the attacker with the contents of the targeted file embedded. The weakness is a classic CWE‑73 path traversal in external command execution. The impact is a confidentiality breach, allowing compromise of sensitive configuration or credential files if an attacker has write permission for files on the host.

The affected product is ConvertX from C4illin. All releases up to and including 0.19.0 are vulnerable. No other vendors or versions are listed.

The CVSS score of 7.1 classifies this as a high‑severity vulnerability, while the EPSS score is not available, indicating no published exploitation probability data at the time. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated users capable of uploading documents to the service; no elevated privileges are required to trigger the read. The exploit path is straightforward: upload a crafted document, convert it, and download the output to retrieve the file contents. No additional network exposure is necessary, and the attack can be carried out from the same network segment as the application if authentication credentials are compromised or mishandled.