1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
libreoffice-convert
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting libreoffice-convert, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-gmxc-r82q-347r | Moderate | libreoffice-convert vulnerable to path traversal / arbitrary file write### Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root). ### Patches Version 1.8.2 uses `path.basename` on `filename` to make sure the temp directory can not be escaped. ### Workarounds Make sure you supply the filename yourself and don' |
| GitHub (opens in a new tab) |
- GHSA-gmxc-r82q-347rModeratelibreoffice-convert vulnerable to path traversal / arbitrary file write
< 1.8.2
### Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root). ### Patches Version 1.8.2 uses `path.basename` on `filename` to make sure the temp directory can not be escaped. ### Workarounds Make sure you supply the filename yourself and don'
CVE: CVE-2026-54732