Résumé
libreoffice-convert vulnerable to path traversal / arbitrary file write
Détails de l’avis
Impact
options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).
Patches
Version 1.8.2 uses path.basename on filename to make sure the temp directory can not be escaped.
Workarounds
Make sure you supply the filename yourself and don't have it user supplied or use path.basename on filename before using it in libreoffice-convert.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
- MEDIUMCVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
- MEDIUMCVE-2026-108258
Shiny for Python has path traversal in bookmark restore
- MEDIUMCVE-2026-107844
Contao: Path traversal in the images controller
- HIGHGHSA-fr26-jjhm-638c
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
- MEDIUMCVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry