CVE-2026-59977 — ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated u…

Published: 2026-10-12 · CVSS: 8.1 · CVSS 3.1

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7