StatewardStateward
← All vulnerabilities
MEDIUMSupply chain

CVE-2026-54732

npm · libreoffice-convert

Summary

libreoffice-convert vulnerable to path traversal / arbitrary file write

Advisory details

Impact

options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).

Patches

Version 1.8.2 uses path.basename on filename to make sure the temp directory can not be escaped.

Workarounds

Make sure you supply the filename yourself and don't have it user supplied or use path.basename on filename before using it in libreoffice-convert.

References

Related vulnerabilities

All Supply chain →