{"vulnerability": "CVE-2026-54732", "sightings": [{"uuid": "fd204047-ecc9-4d98-8082-58411dac3b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54732", "type": "seen", "source": "https://gist.github.com/alon710/795619632fe9ba16f51e5c93358e8801", "content": "# CVE-2026-54732: CVE-2026-54732: Arbitrary File Write via Path Traversal in libreoffice-convert\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54732\n\n## Summary\nA path traversal and arbitrary file write vulnerability exists in the libreoffice-convert Node.js package in all versions prior to 1.8.2. The convertWithOptions function fails to validate or sanitize the caller-controlled options.fileName parameter, allowing directory traversal sequences to write files outside the temporary directory.\n\n## TL;DR\nUnsanitized input in options.fileName allows attackers to perform directory traversal and write arbitrary files anywhere on the host filesystem that the Node.js process can write to, which can lead to remote code execution.\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5\n- **Integrity Impact**: High\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- libreoffice-convert < 1.8.2\n- **libreoffice-convert**: < 1.8.2 (Fixed in: `1.8.2`)\n\n## Mitigation\n\n- Upgrade to libreoffice-convert version 1.8.2 or later to apply the path.basename containment patch.\n- Implement application-level sanitization to normalize and strip directory traversal sequences before parsing options.\n- Ensure Node.js execution occurs under a non-privileged system account with minimal write access.\n- Enforce read-only containers with temporary volumes mounted for specific processing needs.\n\n**Remediation Steps:**\n1. Run 'npm install libreoffice-convert@1.8.2' or 'yarn upgrade libreoffice-convert@1.8.2' in the project directory.\n2. Audit all routes that forward request body parameters to convertWithOptions to verify input validation.\n3. Deploy container security policies that restrict the writable filesystem to dedicated sandbox locations.\n\n## References\n\n- [GHSA-gmxc-r82q-347r: Path traversal in libreoffice-convert](https://github.com/elwerene/libreoffice-convert/security/advisories/GHSA-gmxc-r82q-347r)\n- [Fix Commit b78f17df9b9183bd503fc4635fc8b3df6705047b](https://github.com/elwerene/libreoffice-convert/commit/b78f17df9b9183bd503fc4635fc8b3df6705047b)\n- [CVE-2026-54732 Details on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54732)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54732) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T19:31:53.204017Z"}]}