A critical path traversal vulnerability in ConvertX allows authenticated attackers to delete arbitrary files, potentially leading to total service disruption or system compromise.

The application improperly validates the filename parameter within the POST /delete endpoint, which enables path traversal sequences. This flaw allows an authenticated attacker to perform unauthorized file deletion operations outside of the intended directory.

The ability for an attacker to delete arbitrary files poses a significant risk to system integrity and availability. Depending on the target files, this could lead to the deletion of critical configuration files, application dependencies, or system data, resulting in permanent service downtime. With a CVSS score of 8.1, this vulnerability is considered High, as it directly impacts the availability and integrity of the hosting environment.

Immediate Action: Update the ConvertX application to version 0.17.0 or later, which includes the necessary path validation fixes.

Proactive Monitoring: Review application access logs for repeated requests to the /delete endpoint containing traversal patterns such as "../".

Compensating Controls: Implement strict file system permissions for the service user to ensure it cannot access or modify directories outside of the designated upload folder.

Public Exploit Available: Unknown

The risk posed by unauthorized file deletion is severe and could lead to irreversible damage to the application environment. Administrators must prioritize updating to version 0.17.0 immediately to eliminate this path traversal vector. In the interim, ensure that the application is running with the principle of least privilege regarding file system access to minimize potential damage.