# CVE-2021-23631: convert-svg path traversal via crafted SVG file

Source: https://junglewise.ai/threats/cve-2021-23631-convert-svg-path-traversal-via-crafted-svg-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-23631 · Severity: low · CVSS 3.1 · Published 2022-01-27

The convert-svg libraries are Node.js packages that transform SVG (Scalable Vector Graphics) files into PNG or JPEG images. An attacker can exploit a path traversal flaw by uploading a specially crafted SVG file that tricks the converter into reading arbitrary files from the server's file system and embedding their contents in the output image. This could expose sensitive files such as configuration files, private keys, or system credentials.

Technologies: [convert-svg-core (npm)](https://junglewise.ai/threats/technologies/convert-svg-core). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-23631 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-23631 being exploited in the wild.

**How severe is CVE-2021-23631?** Low severity, with a CVSS score of 3.1, published 27 January 2022.

**Which products and versions are affected?** convert-svg-core (npm) SEMVER:introduced=0,last_affected=0.5.0; convert-svg-to-jpeg (npm) SEMVER:introduced=0,last_affected=0.5.0; convert-svg-to-png (npm) SEMVER:introduced=0,last_affected=0.5.0.

**Is there a fix for CVE-2021-23631?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-23631 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-23631?** Check whether you run convert-svg-core (npm), convert-svg-to-jpeg (npm) or convert-svg-to-png (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal vulnerability (CWE-22) affecting convert-svg-core and its dependents convert-svg-to-png and convert-svg-to-jpeg in all versions up to 0.5.0. The vulnerability occurs because the SVG parser does not properly validate file references embedded in SVG elements (such as iframe src attributes pointing to file:// URLs). An unauthenticated attacker can craft an SVG file containing references to arbitrary file paths (e.g., file:///etc/passwd) and submit it for conversion; the conversion process will fetch and embed the file contents into the output PNG/JPEG image. The attack requires only the ability to supply an SVG file to the converter (network reachable, no authentication required). Patches are available in versions after 0.5.0.

## Affected products

- convert-svg-core (npm) SEMVER:introduced=0,last_affected=0.5.0
- convert-svg-to-jpeg (npm) SEMVER:introduced=0,last_affected=0.5.0
- convert-svg-to-png (npm) SEMVER:introduced=0,last_affected=0.5.0

## Identifiers

- CVE-2021-23631
- GHSA-jv7g-9g6q-cxvw

## Timeline

- 2022-01-21: disclosed: CVE-2021-23631 published to NVD
- 2022-01-27: advisory: GHSA-jv7g-9g6q-cxvw published

## References

- [https://gist.github.com/legndery/a248350bb25b8502a03c2f407cedeb14](https://gist.github.com/legndery/a248350bb25b8502a03c2f407cedeb14)

## Related threats

- [convert-svg-core remote code injection via SVG onload](https://junglewise.ai/threats/cve-2022-25759-convert-svg-core-remote-code-injection-via-svg-onload)
- [convert-svg-core directory traversal in SVG tag parsing](https://junglewise.ai/threats/cve-2022-24278-convert-svg-core-directory-traversal-in-svg-tag-parsing)
- [convert-svg-core arbitrary code injection via SVG](https://junglewise.ai/threats/cve-2022-24429-convert-svg-core-arbitrary-code-injection-via-svg)