← All advisories

High severity7.5NVD Advisory· Published Oct 21, 2019· Updated Jun 17, 2026

CVE-2019-17400

CVE-2019-17400

Description

The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
unoconvPyPI	< 0.9.0	0.9.0

Affected products

3

unoconv/unoconv packagedescription
ghsa-coords
pkg:pypi/unoconv
Range: < 0.9.0
Universal Office Converter Project/Universal Office Converter
cpe:2.3:a:universal_office_converter_project:universal_office_converter:*:*:*:*:*:*:*:*
Range: <0.9

Patches

Vulnerability mechanics

References

6

github.com/unoconv/unoconv/pull/510nvdPatchThird Party AdvisoryWEB
buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversions/nvdExploitThird Party Advisory
github.com/advisories/GHSA-27p5-7cw6-m45hghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2019-17400ghsaADVISORY
buer.haus/2019/10/18/a-tale-of-exploitation-in-spreadsheet-file-conversionsghsaWEB
github.com/pypa/advisory-database/tree/main/vulns/unoconv/PYSEC-2019-213.yamlghsaWEB

News mentions

0

No linked articles in our index yet.