https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:52:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-54732 <p>libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.</p> <p>libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.join(tempDir.name, fileName) without reducing it to a base name. A filename containing ../ can escape the temporary directory because path.basename() normalization is missing and write the supplied document buffer to an arbitrary path writable by the process, including an SSH authorized_keys file, a cron configuration, or a web root. This issue is fixed in version 1.8.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-54732 https://db.gcve.eu/vuln/ghsa-gmxc-r82q-347r <p><strong>Affected:</strong> npm: libreoffice-convert</p> <p>### Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing &#34;../&#34; escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).</p> <p>### Patches Version 1.8.2 uses `path.basename` on `filename` to make sure the temp directory can not be escaped.</p> <p>### Workarounds Make sure you supply the filename yourself and don&#39;t have it user supplied or use `path.basename` on `filename` before using it in `libreoffice-convert`.</p> <p><strong>Affected:</strong> npm: libreoffice-convert</p> <p>### Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing &#34;../&#34; escapes the temporary directory, so a caller can write arbitrary content to an arbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d entry, or a web root).</p> <p>### Patches Version 1.8.2 uses `path.basename` on `filename` to make sure the temp directory can not be escaped.</p> <p>### Workarounds Make sure you supply the filename yourself and don&#39;t have it user supplied or use `path.basename` on `filename` before using it in `libreoffice-convert`.</p> https://db.gcve.eu/vuln/ghsa-gmxc-r82q-347r