ConvertX 0.17.0 allows an authenticated user to read arbitrary files on the hosting server by uploading LaTeX files that contain \input{path} or \verbatiminput{path}. The TeX engine processes these directives during conversion and the resulting PDF includes the raw file contents, giving an attacker direct read access to files that the server process can reach. The vulnerability is a classic path traversal / privilege escalation flaw mapped to CWE-22. The impact is local integrity and confidentiality compromise within the system’s file namespace, potentially exposing configuration files, credentials, or other sensitive data. The problem is limited to authenticated users with write permission to the upload mechanism, and no public unauthenticated web-facing attack vector is documented.

The issue affects the C4illin software suite ConvertX, specifically version 0.17.0. Vulnerable upstream code is visible in the xelatex module and has been patched in the subsequent 0.18.0 release. No other vendors or product variants have reported susceptibility.

With a CVSS score of 7.1, the vulnerability presents moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation. The likely attack vector is an authenticated user with file upload privileges; attackers can craft malicious LaTeX files and trigger the vulnerable conversion routine, resulting in arbitrary file read. In the absence of an official patch, exploitation requires legitimate access to the upload interface.