CVE-2026-54732

Name of the Vulnerable Software and Affected Versions libreoffice-convert versions prior to 1.8.2

Description The index.js file fails to normalize the options.fileName variable using path.basename() when constructing a filesystem path via path.join(tempDir.name, fileName). This allows a caller to provide a filename containing path traversal sequences like ../, enabling the writing of a document buffer to arbitrary paths writable by the process, such as SSH authorized keys files, cron configurations, or web roots.

Recommendations Update to version 1.8.2. As a temporary workaround, ensure the options.fileName variable is not user-supplied or apply path.basename() to the filename before passing it to the module.