CVE-2025-66449

ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.

• CWE-22
• CWE-73
• CWE-434
• CWE-22

• https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30Product
• https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129ePatch
• https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72rExploit, Vendor Advisory
• https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72rExploit, Vendor Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66443Pexip Infinity 35.0 through 38.1 before 39.0, in non-default…5.3
• CVE-2025-66444Cross-site Scripting vulnerability in Hitachi Infrastructure…8.2
• CVE-2025-66445Authorization bypass vulnerability in Hitachi Infrastructure…7.1
• CVE-2025-66446MaxKB is an open-source AI assistant for enterprise. Version…7.5
• CVE-2025-66447Chamilo LMS is a learning management system. From 1.11.0 to …4.7
• CVE-2025-66448vLLM is an inference and serving engine for large language m…8.8
• CVE-2025-6645PDF-XChange Editor U3D File Parsing Use-After-Free Remote Co…7.8
• CVE-2025-66450LibreChat is a ChatGPT clone with additional features. In ve…5.4
• CVE-2025-66451LibreChat is a ChatGPT clone with additional features. In ve…6.5
• CVE-2025-66452LibreChat is a ChatGPT clone with additional features. In ve…6.1
• CVE-2025-66453Rhino is an open-source implementation of JavaScript written…7.5
• CVE-2025-66454Arcade MCP allows you to to create, deploy, and share MCP Se…6.5