CVE-2026-54732: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54732 is a path traversal / arbitrary file write vulnerability in the libreoffice-convert npm package (by elwerene), a Node.js module used to convert office documents to different formats. The vulnerability exists in all versions prior to 1.8.2 and was first disclosed on July 4, 2026, with the GitHub Advisory Database entry published on August 27, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium/Moderate) (GitHub Advisory).

The root cause is a missing path.basename() normalization on the caller-supplied options.fileName parameter (CWE-22: Path Traversal). In index.js, the library constructs a filesystem path using path.join(tempDir.name, fileName) and writes the caller-supplied document buffer to that path without sanitizing fileName first. An attacker who can control the fileName option can supply a value containing ../ sequences (e.g., ../../home/user/.ssh/authorized_keys) to escape the intended temporary directory and write arbitrary content to any path writable by the Node.js process. The fix, introduced in commit b78f17d, applies path.basename() to the filename before use: const fileName = path.basename((options || {}).fileName || 'source'); (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated network attacker to write arbitrary content to any filesystem location the Node.js process has write access to. High-value targets include ~/.ssh/authorized_keys (enabling unauthorized SSH access), /etc/cron.d/ entries (enabling persistent code execution), or web root directories (enabling web shell deployment). There is no confidentiality or availability impact directly, but the integrity impact is rated High, and the arbitrary file write primitive can readily be chained to achieve remote code execution or privilege escalation (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires low privileges (an authenticated caller who can influence the fileName parameter passed to the library), no user interaction, and low attack complexity over a network vector. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a web application or service that uses the libreoffice-convert npm package (versions < 1.8.2) and exposes an endpoint that accepts a user-controlled filename for document conversion.
2. Craft malicious fileName: Construct a fileName value containing path traversal sequences, such as ../../home/nodeuser/.ssh/authorized_keys, to target a sensitive file outside the temporary directory.
3. Prepare payload: Prepare the document buffer (the content to be written) — for example, an attacker-controlled SSH public key or a cron job script.
4. Invoke the library: Trigger the conversion call (e.g., via an API request) with the malicious fileName and the crafted document buffer as the document argument, causing the library to execute path.join(tempDir.name, '../../home/nodeuser/.ssh/authorized_keys') and write the buffer to that resolved path.
5. Achieve persistence or code execution: With the SSH key written to authorized_keys, authenticate via SSH as the target user; or with a cron entry written, wait for scheduled execution of the injected command (GitHub Advisory, Fix Commit).

• File System: Unexpected or modified files in sensitive locations such as ~/.ssh/authorized_keys, /etc/cron.d/, or web root directories (e.g., newly created .php, .js, or .sh files); files with timestamps matching suspicious conversion activity.
• Logs: Application logs showing document conversion requests with fileName values containing ../ sequences; Node.js process errors or unexpected file write operations outside the libreofficeConvert_* temporary directory prefix.
• Process: Unexpected cron job executions or new SSH sessions originating from unknown IP addresses following a conversion request; child processes spawned from the Node.js service account that are inconsistent with normal operation.
• Network: New or unexpected inbound SSH connections to the server; outbound connections from the Node.js process to unknown external hosts following a conversion event.

Upgrade libreoffice-convert to version 1.8.2 or later, which applies path.basename() to the fileName parameter before constructing the temporary file path (GitHub Advisory, Fix Commit). If immediate upgrade is not possible, apply one of the following workarounds: (1) ensure the fileName option is always set by the application itself and never derived from untrusted user input, or (2) apply path.basename() to any user-supplied filename before passing it to libreoffice-convert. Running the Node.js process under a least-privilege account will also limit the blast radius of any successful exploitation.

The vulnerability was reported by security researcher Santoshkumarpuppala, who also published a write-up on dev.to describing how an unchecked filename parameter allowed the popular npm document converter to write to arbitrary paths on disk (GitHub Advisory). No major vendor statements or widespread media coverage have been identified beyond the GitHub advisory and OSV database entries.