GHSA-GMXC-R82Q-347R
Vulnerability from github – Published: 2026-08-27 17:23 – Updated: 2026-08-27 17:23Impact
options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).
Patches
Version 1.8.2 uses path.basename on filename to make sure the temp directory can not be escaped.
Workarounds
Make sure you supply the filename yourself and don't have it user supplied or use path.basename on filename before using it in libreoffice-convert.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "libreoffice-convert"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54732"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-27T17:23:16Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\noptions.fileName is used to build a filesystem path\n(path.join(tempDir.name, fileName)) and the caller-supplied document buffer is\nwritten there, but fileName is never reduced to a base name. A fileName containing\n\"../\" escapes the temporary directory, so a caller can write arbitrary content to an\narbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d\nentry, or a web root).\n\n### Patches\nVersion 1.8.2 uses `path.basename` on `filename` to make sure the temp directory can not be escaped.\n\n### Workarounds\nMake sure you supply the filename yourself and don\u0027t have it user supplied or use `path.basename` on `filename` before using it in `libreoffice-convert`.",
"id": "GHSA-gmxc-r82q-347r",
"modified": "2026-08-27T17:23:16Z",
"published": "2026-08-27T17:23:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/elwerene/libreoffice-convert/security/advisories/GHSA-gmxc-r82q-347r"
},
{
"type": "WEB",
"url": "https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b"
},
{
"type": "PACKAGE",
"url": "https://github.com/elwerene/libreoffice-convert"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "libreoffice-convert vulnerable to path traversal / arbitrary file write"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.