CVE-2026-108694 C4illin CVE debrief

Who should care

System administrators and security teams responsible for ConvertX installations, especially those using version 0.19.0 or earlier, should assess their exposure and take necessary actions to mitigate the risk. This includes verifying the version of ConvertX in use, restricting access to sensitive files, and monitoring for suspicious activities that could indicate exploitation attempts.

Why it matters

CVE-2026-108694 is a high-severity vulnerability in ConvertX that allows authenticated users to read arbitrary server files due to the lack of the --sandbox flag in the Pandoc converter. Defenders should prioritize verifying the presence of this vulnerability in their installations, especially if using version 0.19.0 or earlier, and implement compensating controls to mitigate unauthorized file access risks.

• Potential unauthorized access to sensitive server files
• Possible data breaches due to file contents exposure
• Need for verification of ConvertX version and patch application
• Requirement for enhanced monitoring of file access patterns

Technical summary

The vulnerability in ConvertX through version 0.19.0 allows authenticated users to read arbitrary server files. This is possible because the Pandoc converter is invoked without the --sandbox flag. An attacker can exploit this by uploading a reStructuredText document with an include directive that names an absolute path on the server. When the document is converted, the output will contain the contents of the referenced file, allowing unauthorized access to server files.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their ConvertX installations, especially if the version is 0.19.0 or earlier, and ensure that appropriate compensating controls are in place to mitigate the risk of unauthorized file access.

Recommended defensive actions

• Verify ConvertX version and apply patches if available
• Restrict access to sensitive server files
• Monitor for suspicious file access attempts
• Implement additional security measures for file access control
• Perform vulnerability scanning to identify exposed systems
• Review system logs for indicators of compromise
• Conduct a thorough risk assessment to prioritize mitigation efforts

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in ConvertX versions up to 0.19.0 and the mechanism of exploitation through the Pandoc converter. However, specific details about affected environments, exploitation attempts, or successful attacks are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.