Executive brief
libreoffice-convert is a popular npm package that converts documents using LibreOffice. The library accepts a filename from callers and writes converted document data to a temporary directory, but does not properly validate the filename, allowing directory traversal. An attacker who controls the filename parameter can write files to arbitrary locations on the system (such as ~/.ssh/authorized_keys or web root directories), potentially enabling account takeover, malicious cron job execution, or code execution depending on file permissions.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the filename sanitization logic. The vulnerable code uses path.join(tempDir.name, fileName) directly without normalizing the fileName parameter to a basename, allowing sequences like "../" to escape the intended temporary directory. The attack requires the attacker to control the fileName option passed to the library—either through direct API calls or by supplying malicious document names to an application that uses libreoffice-convert without sanitizing filenames first. No authentication or user interaction is required if the attacker can directly invoke the affected function. The patch in version 1.8.2 applies path.basename() to strip directory traversal components. Versions prior to 1.8.2 are vulnerable.
Affected products
- elwerene libreoffice-convert < 1.8.2
Timeline
- 2026-07-04: disclosed
- 2026-08-27: advisory
- 2026-08-27: patched: Version 1.8.2 released with path.basename() fix
References
- https://api.github.com/users/Santoshkumarpuppala
- https://github.com/Santoshkumarpuppala
- https://api.github.com/users/Santoshkumarpuppala/gists%7B/gist_id%7D
- https://api.github.com/users/Santoshkumarpuppala/repos
- https://avatars.githubusercontent.com/u/24365101?v=4
- https://api.github.com/users/Santoshkumarpuppala/events%7B/privacy%7D