CVE-2025-66449

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-73 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Dec 16, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-66457.8PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut CVE-2025-664505.4LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of t CVE-2025-664516.5LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define CVE-2025-664526.1LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError CVE-2025-664537.5Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application p CVE-2025-664546.5Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worke CVE-2025-664559.8LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, CVE-2025-664569.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4 CVE-2025-664578.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4 CVE-2025-664586.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-664596.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-66463.3PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to discl