CVE-2026-54732: CVE-2026-54732: Arbitrary File Write via Path Traversal in libreoffice-convert

#security #cve #cybersecurity

CVE-2026-54732: Arbitrary File Write via Path Traversal in libreoffice-convert

Vulnerability ID: CVE-2026-54732
CVSS Score: 6.5
Published: 2026-08-27

A path traversal and arbitrary file write vulnerability exists in the libreoffice-convert Node.js package in all versions prior to 1.8.2. The convertWithOptions function fails to validate or sanitize the caller-controlled options.fileName parameter, allowing directory traversal sequences to write files outside the temporary directory.

TL;DR

Unsanitized input in options.fileName allows attackers to perform directory traversal and write arbitrary files anywhere on the host filesystem that the Node.js process can write to, which can lead to remote code execution.

Technical Details

CWE ID: CWE-22
Attack Vector: Network
CVSS Score: 6.5
Integrity Impact: High
Exploit Status: none
KEV Status: Not Listed

Affected Systems

libreoffice-convert < 1.8.2
libreoffice-convert: < 1.8.2 (Fixed in: 1.8.2)

Code Analysis

Commit: b78f17d

sanitize filename with path.basename

@@ -11,7 +11,7 @@
-    const fileName = (options || {}).fileName || 'source';
+    const fileName = path.basename((options || {}).fileName || 'source');

Mitigation Strategies

Upgrade to libreoffice-convert version 1.8.2 or later to apply the path.basename containment patch.
Implement application-level sanitization to normalize and strip directory traversal sequences before parsing options.
Ensure Node.js execution occurs under a non-privileged system account with minimal write access.
Enforce read-only containers with temporary volumes mounted for specific processing needs.

Remediation Steps:

Run 'npm install libreoffice-convert@1.8.2' or 'yarn upgrade libreoffice-convert@1.8.2' in the project directory.
Audit all routes that forward request body parameters to convertWithOptions to verify input validation.
Deploy container security policies that restrict the writable filesystem to dedicated sandbox locations.

References

Read the full report for CVE-2026-54732 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community