CVE-2026-105080: ConvertX Code Execution

What Happened, in Brief

CVE-2026-105080 affects ConvertX, an application that uses external conversion tools, including Calibre’s ebook-convert. In vulnerable releases, the Calibre conversion path does not block .recipe and .downloaded_recipe files before passing them to Calibre. Those formats can contain executable code, allowing attacker-controlled input to execute code inside the ConvertX processing environment.

The available record assigns the vulnerability a CVSS v3 base score of 9.9, Critical. The precise CVSS vector was not included in the retrieved record, so the attack-vector and authentication components should be verified against the authoritative NVD entry or GitHub security advisory before being copied into a formal risk register.

What’s the Root Cause?

The root cause is insufficient file-type handling in converters/calibre.ts. ConvertX accepts input that can be interpreted as a Calibre recipe and sends it to ebook-convert instead of rejecting it or routing it through a safe, non-executable conversion path. The failure occurs at the trust boundary between uploaded or otherwise attacker-controlled files and the Calibre subprocess.

Calibre recipe files are not ordinary document containers. They can contain executable logic used to describe how content is retrieved or processed. Passing such a file to a capable interpreter or conversion utility can allow code to execute with the privileges available to the ConvertX service. The practical impact depends on how ConvertX is exposed, what inputs unauthenticated or low-privilege users can submit, and the filesystem and network permissions granted to the service.

This is not merely a filename-extension concern. Blocking one spelling or relying on client-provided MIME types may be insufficient. Defenders should assume that recipe files may be renamed, compressed, or submitted through alternate conversion workflows, then enforce restrictions at the application and deployment layers.

Analyst’s Take: Upgrade first, then investigate the conversion path. The absence of a verified public PoC or confirmed exploitation lowers the evidence of active exploitation, but it does not remove the risk where an exposed service accepts attacker-controlled files and runs with broad permissions.

Who Needs to Act

Organizations running ConvertX versions earlier than 0.19.0 should treat those installations as vulnerable. The available vulnerability record does not identify a narrower affected subrange, so every release before 0.19.0 should be considered affected unless the project provides a more specific determination.

The fixed release is ConvertX 0.19.0. Administrators should verify the actual deployed image, package, or binary rather than relying on a repository tag or a source checkout. Container environments are particularly likely to retain an old vulnerable image after a host-level update.

Teams should identify systems that invoke ConvertX indirectly, including document portals, automation pipelines, API gateways, and shared conversion services. A vulnerable backend may be exploitable even when ConvertX itself is not directly reachable from the internet.

Why This CVSS Score?

The 9.9 Critical score reflects the potential for code execution through a crafted input file passed to Calibre. Code execution in a server-side conversion service can affect confidentiality, integrity, and availability, particularly where the process can access uploaded files, temporary directories, credentials, internal services, or container metadata.

The retrieved NVD result did not include the complete CVSS vector. It is therefore not safe to claim specific values for attack vector, attack complexity, privileges required, user interaction, or scope. The score should be interpreted as a high-impact base assessment, not as evidence that every ConvertX deployment is remotely exploitable without authentication.

Operational exposure varies significantly. A public upload endpoint with no authentication and broad service permissions presents a materially greater risk than an isolated, authenticated batch converter running under a restricted account. Network reachability, accepted file types, conversion-job authorization, and the service’s access to secrets should be included in local risk scoring.

Has It Been Exploited?

No confirmed in-the-wild exploitation was identified in the supplied research. CVE-2026-105080 was not listed in the CISA Known Exploited Vulnerabilities catalog at the time of checking. There is no CISA date-added date, federal remediation deadline, required-action entry, or ransomware-campaign flag for this CVE.

No verified public proof-of-concept repository was identified in the available primary references. That status can change after publication, and the absence of a public PoC or KEV entry does not demonstrate that exploitation is impossible. A crafted recipe file is a plausible attack vehicle wherever an attacker can submit files for Calibre-backed conversion.

Treat internet-accessible or multi-tenant ConvertX deployments as urgent regardless of current exploitation evidence. Patch before waiting for a public exploit, and preserve relevant logs before changing retention settings or rebuilding containers.

How Do I Know If I’m Hit?

Start by inventorying running versions and reviewing conversion activity since the oldest retained logs. Look for .recipe and .downloaded_recipe files in upload, staging, temporary, and output directories. Pay attention to files that have a document-looking name but a recipe extension, mismatched MIME type, unusual size, or a submission immediately followed by unexpected outbound traffic.

The strongest host-level indicator is unexpected invocation of Calibre by the ConvertX process, especially when the input path ends in a recipe extension. The following queries are starting points and should be adapted to the deployed logging format:

# Search common application and system logs for recipe submissions or Calibre execution
grep -R -Ei '\.(recipe|downloaded_recipe)\b|ebook-convert|calibre' \
  /var/log /opt/convertx/logs 2>/dev/null

# Find recent recipe-like files in common temporary and upload locations
find /tmp /var/tmp /data /app -type f \
  \( -iname '*.recipe' -o -iname '*.downloaded_recipe' \) \
  -mtime -30 -ls 2>/dev/null

For endpoint detection or SIEM pipelines, alert on a process relationship similar to:

parent_process=convertx* AND process_name=ebook-convert
AND (command_line CONTAINS ".recipe"
     OR command_line CONTAINS ".downloaded_recipe")

Also investigate child processes launched by ebook-convert, unexpected shell interpreters, network utilities, scripting runtimes, credential-file access, and outbound connections from the ConvertX container or service account. These signals are not proof of compromise, but they can identify conversion jobs requiring containment and review.

Organizations that need broader visibility across hosts should correlate these events with endpoint detection telemetry and review guidance on what EDR is.

What Do I Do About It?

Upgrade ConvertX to 0.19.0 or later. The upstream release and associated fix commit identify the remediation. For a source-based deployment, update the checkout and rebuild. For a container deployment, pull or build an image containing the fixed release and redeploy all replicas.

# Example source-based workflow; use the project’s documented build and service commands
git fetch --tags origin
git checkout v0.19.0
npm ci
npm run build

# Rebuild and redeploy a container image where applicable
docker build --pull -t convertx:0.19.0 .
docker compose up -d --force-recreate

The exact build commands may differ by deployment method. Confirm the running version from the application’s documented version endpoint, package metadata, image label, or release output. Do not consider a source update complete until old containers, workers, and scheduled jobs have been replaced.

If an upgrade cannot be completed immediately, disable or restrict Calibre-based conversion and block .recipe and .downloaded_recipe uploads at the application or reverse-proxy layer. These are defense-in-depth measures, not substitutes for the fixed release. Run ConvertX as a dedicated unprivileged user, remove unnecessary filesystem and network access, avoid mounting host-sensitive paths, and keep secrets outside the process environment where possible.

For organizations reviewing endpoint activity after a suspicious conversion job, Malwarebytes may provide an additional layer of malware detection and remediation support. Use it as a complement to patching, logging, least privilege, and incident-response procedures—not as a replacement for them.

# Temporary upload restriction example; validate against the application’s routing
location / {
    if ($request_uri ~* "\.(recipe|downloaded_recipe)(/|$)") {
        return 403;
    }
}

Finally, review potentially malicious jobs, rotate credentials accessible to the ConvertX process if compromise is suspected, and preserve container, application, proxy, and host telemetry before rebuilding affected workloads. Least-privilege controls and just-in-time permissions can further reduce exposure; see what just-in-time access is.

Where This Comes From

The primary references identify the vulnerable code path, the fixed release, and the security advisory:

1. GitHub security advisory: GHSA-m4hh-rqmf-c8hw
2. ConvertX 0.19.0 release
3. Upstream fix commit
4. CISA Known Exploited Vulnerabilities Catalog

The retrieved vulnerability data reports CVE-2026-105080 as affecting ConvertX before 0.19.0, with a CVSS score of 9.9, but does not provide the full CVSS vector in the available result. Security teams should use the authoritative CVE or vendor advisory record for final scoring documentation and monitor those sources for updates to exploitation status, affected versions, or remediation guidance.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.