CSRF in C4illin Convertx
CVE-2026-59977
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/{id}, the browser sends the user session cookie and the request deletes the targeted job, resulting in unauthorized loss of converted-file history. This issue is fixed in version 0.18.0.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- C4illin Convertx — versions < 0.18.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-59977?
- CVE-2026-59977 is a high-severity vulnerability in C4illin Convertx, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.1/10. Published 2026-10-12.
- How severe is CVE-2026-59977?
- High severity. CVSS v3 base score is 8.1 out of 10.