Directory Traversal

Vulnerability

All versions of the convert-svg-core, convert-svg-to-png, and convert-svg-to-jpeg packages are affected by a directory traversal vulnerability [1][2][3][4]. The packages use a headless Chromium instance to convert SVG input into PNG or JPEG images. When processing a specially crafted SVG file containing an ` element with a src attribute pointing to a file://` URL, Chromium fetches the local file and renders it. The resulting image includes the contents of the targeted file, leading to arbitrary file read [2].

Exploitation

An attacker must supply a malicious SVG document to an application that uses any of the affected packages to convert user‑supplied SVG files. The exploit requires no authentication if the application exposes the conversion endpoint publicly [1]. The proof‑of‑concept (PoC) provided by Aritra Chakraborty demonstrates sending an SVG that embeds an ` alongside valid SVG elements. When the application calls convert() on the SVG, the headless Chromium browser reads the local /etc/passwd` file and includes its content in the rendered bitmap, which is then returned as a PNG image to the attacker [2][3][4].

Impact

Successful exploitation results in information disclosure – the attacker can read arbitrary files on the server’s file system, such as /etc/passwd, application source code, or configuration secrets. The attacker obtains the file contents as the pixel data of the generated image. The confidentiality of the system is compromised; no modification of data or code execution is achieved [1][2].

Mitigation

Upgrade the affected packages to version 0.6.0 or higher, which addresses the directory traversal issue [2][3][4]. No workaround has been published that does not involve updating the package. At the time of disclosure, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.