CVE-2025-66449

{"id": "CVE-2025-66449", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66449", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T14:36:29.538776Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "C4illin", "product": "ConvertX", "versions": [{"status": "affected", "version": "< 0.16.0"}]}]}], "published": "2025-12-16T01:15:51.750", "references": [{"url": "https://github.com/C4illin/ConvertX/blob/4ae2aab66ace7cdcc14c5a16ecaaf2372b9ccbdf/src/pages/upload.tsx#L27-L30", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/C4illin/ConvertX/commit/550f472451755d095cf5802bc91f403e85b7129e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/C4illin/ConvertX/security/advisories/GHSA-cpww-gwgc-p72r", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-434"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on the system, overwriting binaries and allowing code execution. The upload function takes `file.name` directly from user supplied data without doing any sanitization on the name thus allowing for arbitrary file write. This can be used to overwrite system binaries with ones provided from an attacker allowing full code execution. Version 0.16.0 contains a patch for the issue."}, {"lang": "es", "value": "ConvertX es un conversor de archivos en l\u00ednea autoalojado. En versiones anteriores a la 0.16.0, el endpoint '/upload' permite a un usuario autenticado escribir archivos arbitrarios en el sistema, sobrescribiendo binarios y permitiendo la ejecuci\u00f3n de c\u00f3digo. La funci\u00f3n de carga toma 'file.name' directamente de los datos proporcionados por el usuario sin realizar ninguna sanitizaci\u00f3n en el nombre, lo que permite la escritura arbitraria de archivos. Esto puede usarse para sobrescribir binarios del sistema con los proporcionados por un atacante, permitiendo la ejecuci\u00f3n completa de c\u00f3digo. La versi\u00f3n 0.16.0 contiene un parche para el problema."}], "lastModified": "2026-10-07T19:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:c4illin:convertx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F67602C7-26D1-4477-AE93-85CE2AAE6A3D", "versionEndExcluding": "0.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}