A CSRF flaw in ConvertX allows an attacker to delete a job’s converted-file history by exploiting a GET endpoint that permanently removes a job without any CSRF protection. An authenticated user who visits malicious content can trigger a browser request to /delete/{id} while the user’s session cookie is sent automatically, resulting in an irreversible loss of the user’s job history.

The vulnerability affects the ConvertX file conversion service developed by C4illin. Versions prior to 0.18.0, including any release earlier than v0.18.0, are susceptible to exploitation.

The CVSS score of 8.1 classifies the vulnerability as High severity. EPSS data is unavailable, and the flaw has not been listed in CISA’s KEV catalog. The attack requires that an authenticated user be tricked into loading attacker-controlled content; it does not require direct network access to the server and can occur remotely through a web browser. Successful exploitation leads to permanent loss of job history, impacting data availability for the affected user.