ConvertXis a self-hosted online file converter. In versions prior to 0.17.0, the `POST /delete` endpoint uses a user-controlled `filename` value to construct a …

CVE-2026-24741 affects ConvertX, a self-hosted online file converter, in versions prior to 0.17.0. The vulnerability exists in the POST /delete endpoint which uses user-controlled filename values to construct filesystem paths without proper validation. Attackers can exploit this by supplying path traversal sequences like ../ to delete arbitrary files outside the intended uploads directory. The impact is limited only by the permissions of the server process. The issue has been fixed in version 0.17.0.