rootpwn

critical · CVSS v3 9.9 · CVSS v4 9.4

CVE-2026-105080

ConvertX versions prior to 0.19.0 allow recipe files to be passed directly to Calibre's ebook-convert program, enabling execution of arbitra

Overview

ConvertX versions prior to 0.19.0 allow recipe files to be passed directly to Calibre's ebook-convert program, enabling execution of arbitrary code contained in .recipe or .downloaded_recipe files. This flaw can be exploited by attackers who supply malicious recipe files to a vulnerable ConvertX instance. The vulnerability is critical and can lead to full compromise of affected systems.

Description

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

Impact

The flaw violates confidentiality by allowing attackers to read sensitive data, integrity by enabling arbitrary code execution that can modify files or install malware, and availability by potentially crashing or disabling the conversion service. Administrators of systems that use ConvertX to process eBook recipes are directly impacted, as are end users who rely on those conversions for legitimate content.

Remediation

Upgrade ConvertX to version 0.19.0 or later where recipe files are properly blocked. If an upgrade is not immediately possible, disable or remove the recipe file handling feature, validate recipe files against a whitelist, and run ebook-convert in a sandboxed environment. Monitor logs for unexpected recipe file usage and apply system hardening to limit execution privileges.

Risk context

The CVSS v3 score of 9.9 and critical severity indicate a high urgency for remediation. With no EPSS data available, the risk remains significant for any environment still running vulnerable ConvertX versions.

Affected products

  • ConvertX
  • Calibre

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
9.4
EPSS
—

ConvertX Calibre recipe-file code-execution critical sandbox patch

← All CVEs

Related CVEs

critical

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

View analysis

critical

CVE-2026-79113

OpenAPV versions prior to 1.1.1.0 contain a heap-based buffer overflow in the read_bitstream function, allowing attackers to corrupt memory and potentially execute arbitrary code. This flaw can be exploited remotely by sending crafted data to vulnerable systems. The vulnerability is critical, with a CVSS v3 score of 9.8.

View analysis

critical

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addresses, login names, and registration dates via the Member Directory's per-row user rebinding when attacker-controlled base64 payloads in the [pp-custom-html] shortcode invoke [profile-email], [profile-username], and [profile-date-registered]. When the WordPress users_can_register option is enabled, unauthenticated attackers can also exploit this vulnerability by supplying the split shortcode fragments through the plugin's own registration handler, which processes the reg_nickname and reg_bio fields without a nonce requirement.

View analysis

critical

CVE-2026-97644

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.

View analysis