The vulnerability in libreoffice-convert allows a caller to supply a document filename that contains directory traversal sequences. Because the module concatenates this filename to a temporary directory without sanitization, an attacker can write the processed document buffer to any location writable by the process. This results in arbitrary file creation or overwrite, potentially compromising privileged configuration files such as SSH authorized_keys, cron jobs, or web root contents. The weakness is a classic path traversal flaw (CWE-22).

The affected product is the Node.js module libreoffice-convert from the elwerene project, versions prior to 1.8.2. The issue manifests whenever the module processes a filename supplied by an external trust boundary. Specific versions older than 1.8.2 are impacted; 1.8.2 and later contain the fix.

The CVSS score of 6.5 indicates a moderate to high severity. EPSS data is not available, so precise exploitation frequency cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote exploitation via an application that uses libreoffice-convert and accepts untrusted filenames. Once the module writes the payload, the attacker gains the same privileges as the Node.js process, which can be a system-level user in many hosting scenarios. The vulnerability can lead to full compromise of the host system if critical configuration files are overwritten.