ConvertX has a path traversal flaw in the ImageMagick converter. By supplying directory traversal sequences in the unsanitized convert_to parameter, an attacker can cause the constructed output path to escape the intended directory. This allows the attacker to write the converted image to an arbitrary location within the ConvertX container file system, which could overwrite existing files or trigger a denial of service. The weakness is classified as CWE‑22 and CWE‑73.

The vulnerability affects all instances of ConvertX before version 0.18.0. It is relevant for self‑hosted deployments where the /convert endpoint is reachable either by authenticated users or by unauthenticated users when the service is configured to allow unrestricted access. No other product versions are listed; the advisory states that the issue is fixed in 0.18.0.

The advertised CVSS score is 8.1, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires the ability to upload an extensionless image via the /convert endpoint and supply a traversal payload in the convert_to field. This can be performed by any user with upload access, so the risk is significant for environments with permissive authentication settings.