# CVE-2026-59977: ConvertX CSRF in file deletion endpoint

Source: https://junglewise.ai/threats/cve-2026-59977-convertx-is-a-self-hosted-file-conversion-service-prior-to-0-18-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-59977 · Severity: high · CVSS 8.1 · Published 2026-10-12

ConvertX is a self-hosted file conversion service that stores conversion job history. Prior to version 0.18.0, the deletion endpoint was unprotected against cross-site request forgery (CSRF), allowing an attacker to trick an authenticated user into deleting their job records by visiting malicious content. This results in unauthorized loss of user data and work history.

Technologies: [C4illin ConvertX](https://junglewise.ai/threats/technologies/convertx). Vendors: [C4illin](https://junglewise.ai/threats/vendors/c4illin).

## Quick answers

**Is CVE-2026-59977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59977 being exploited in the wild.

**How severe is CVE-2026-59977?** High severity, with a CVSS score of 8.1, published 12 October 2026.

**Which products and versions are affected?** C4illin ConvertX before 0.18.0.

**Is there a fix for CVE-2026-59977?** Yes: fixed in 0.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59977 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-59977?** Check whether you run C4illin ConvertX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.18.0

## Technical details

The /delete/{id} endpoint in ConvertX uses HTTP GET requests for permanent deletion of conversion jobs without CSRF tokens. An authenticated attacker can craft a malicious webpage that triggers an HTTP GET request to the endpoint; when a legitimate user visits the attacker's page while logged into ConvertX, their browser automatically sends the session cookie, causing job deletion. The vulnerability was fixed in version 0.18.0 by adding proper CSRF protections.

## Affected products

- C4illin ConvertX before 0.18.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/C4illin/ConvertX/commit/e1253267208e439f28c4ffcaff7a81d62cdffadb](https://github.com/C4illin/ConvertX/commit/e1253267208e439f28c4ffcaff7a81d62cdffadb)
- [https://github.com/C4illin/ConvertX/releases/tag/v0.18.0](https://github.com/C4illin/ConvertX/releases/tag/v0.18.0)

## Related threats

- [ConvertX xelatex arbitrary file read via LaTeX input directives](https://junglewise.ai/threats/cve-2026-85618-convertx-xelatex-arbitrary-file-read-via-latex-input-directives)
- [ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an…](https://junglewise.ai/threats/cve-2025-66449-convertxis-a-self-hosted-online-file-converter-in-versions-prior)