{"id":"CVE-2026-54732","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-54732","summary":"libreoffice-convert vulnerable to path traversal / arbitrary file write","details":"### Impact\noptions.fileName is used to build a filesystem path\n(path.join(tempDir.name, fileName)) and the caller-supplied document buffer is\nwritten there, but fileName is never reduced to a base name. A fileName containing\n\"../\" escapes the temporary directory, so a caller can write arbitrary content to an\narbitrary path the process can write to (e.g. ~/.ssh/authorized_keys, an /etc/cron.d\nentry, or a web root).\n\n### Patches\nVersion 1.8.2 uses `path.basename` on `filename` to make sure the temp directory can not be escaped.\n\n### Workarounds\nMake sure you supply the filename yourself and don't have it user supplied or use `path.basename` on `filename` before using it in `libreoffice-convert`.","published":"2026-08-27T17:23:16Z","modified":"2026-08-27T17:30:06.728397597Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"libreoffice-convert","fixedVersion":"1.8.2"}],"fix":{"url":"https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b","label":"elwerene/libreoffice-convert@b78f17d"},"references":[{"type":"WEB","url":"https://github.com/elwerene/libreoffice-convert/security/advisories/GHSA-gmxc-r82q-347r"},{"type":"WEB","url":"https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b"},{"type":"PACKAGE","url":"https://github.com/elwerene/libreoffice-convert"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T17:30:06.728397597Z"}}