important · Edge / RCE
A normal ConvertX account can execute code by uploading a Calibre recipe.
Affects
ConvertX, a self-hosted online file-conversion service normally deployed as a Linux container.
ConvertX passed uploaded recipe files to ebook-convert, which treats them as executable Python.
Detail and 4 sources
Authentication is required by default, while ALLOW_UNAUTHENTICATED deployments expose a cheaper route.
The upstream fix rejects both executable recipe extensions before invoking ebook-convert.