CVE-2026-105080

Published: Ott 03, 2026 Last Modified: Ott 03, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,4
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL 9,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

829

Inclusion of Functionality from Untrusted Control Sphere

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability
Potential Impacts:
Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/C4illin/ConvertX/commit/0ca17dad7fa65e2e…
https://github.com/C4illin/ConvertX/commit/0ca17dad7fa65e2e34823b59b95dd00bb106…
https://github.com/C4illin/ConvertX/releases/tag/v0.19.0
https://github.com/C4illin/ConvertX/releases/tag/v0.19.0
https://github.com/C4illin/ConvertX/security/advisories/GHS…
https://github.com/C4illin/ConvertX/security/advisories/GHSA-m4hh-rqmf-c8hw