CVE-2025-66449

Name: CVE-2025-66449
Creator: NVD / NIST
Published: 2025-12-16T01:15:51.75+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.67%

Last modified Jun 17, 2026

CVE-2025-66449 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. EPSS estimates a 0.67% chance of exploitation in the next 30 days.

Description

ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.67%

47.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
C4illin	Convertx	< 0.16.0

References

https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30Product
https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129ePatch
https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72rExploit, Vendor Advisory
https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72rExploit, Vendor Advisory

Timeline

Published: Dec 16, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-66449?

How severe is CVE-2025-66449?

CVE-2025-66449 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.67% probability of exploitation in the next 30 days.

How do I fix CVE-2025-66449?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-66449?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST