ConvertX is a self‑hosted file converter that, before version 0.17.0, constructs file paths for deletion from a user‑supplied filename without sufficient validation. By sending a POST to /delete with a path traversal sequence such as ../, an attacker can cause the server to delete arbitrary files outside the uploads directory. The scope of damage depends on the privileges of the server process, potentially allowing deletion of critical system files, logs, or configuration files, leading to data loss, denial of service, or privilege escalation.

The vulnerability affects all deployments of ConvertX from the earliest release up to but excluding version 0.17.0. The affected vendor is C4illin, product ConvertX.

The CVSS score of 8.1 indicates a high severity flaw, and the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not in the CISA KEV catalog. Exploitation requires remote access to the HTTP endpoint and crafting a malicious POST request; the damage is limited only by the permissions granted to the server process.