CVE-2026-54732
libreoffice-convert: path traversal / arbitrary file write
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.
| CWE | CWE-22 |
| Vendor | elwerene |
| Product | libreoffice-convert |
| Published | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for elwerene libreoffice-convert
Be the first to know when new medium vulnerabilities affecting elwerene libreoffice-convert are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
elwerene / libreoffice-convert
< 1.8.2