From edea7a55dcbb7b8eff360e47fd4c19b1121b4016 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Sun, 8 Feb 2026 12:50:48 +0100
Subject: [PATCH] security: fix path traversal vulnerability in conversion API

---
 src/converters/main.ts | 12 +++++++-----
 src/pages/convert.tsx  |  2 +-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/converters/main.ts b/src/converters/main.ts
index cee3a30..d258b76 100644
--- a/src/converters/main.ts
+++ b/src/converters/main.ts
@@ -164,13 +164,15 @@ export async function handleConvert(
     const toProcess: Promise<string>[] = [];
     for (const fileName of chunk) {
       const filePath = `${userUploadsDir}${fileName}`;
-      const fileTypeOrig = fileName.split(".").pop() ?? "";
+      const fileTypeOrig = fileName.includes(".") ? (fileName.split(".").pop() ?? "") : "";
       const fileType = normalizeFiletype(fileTypeOrig);
       const newFileExt = normalizeOutputFiletype(convertTo);
-      const newFileName = fileName.replace(
-        new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`),
-        newFileExt,
-      );
+      let newFileName: string;
+      if (fileTypeOrig === "") {
+        newFileName = `${fileName}.${newFileExt}`;
+      } else {
+        newFileName = fileName.replace(new RegExp(`${fileTypeOrig}(?!.*${fileTypeOrig})`), newFileExt);
+      }
       const targetPath = `${userOutputDir}${newFileName}`;
       toProcess.push(
         new Promise((resolve, reject) => {
diff --git a/src/pages/convert.tsx b/src/pages/convert.tsx
index 6ae9825..c1046b6 100644
--- a/src/pages/convert.tsx
+++ b/src/pages/convert.tsx
@@ -47,7 +47,7 @@ export const convert = new Elysia().use(userService).post(
     const convertTo = normalizeFiletype(body.convert_to.split(",")[0] ?? "");
     const converterName = body.convert_to.split(",")[1];
 
-    if (!converterName) {
+    if (!converterName || convertTo.includes("/") || convertTo.includes("\\") || convertTo.includes("..")) {
       return redirect(`${WEBROOT}/`, 302);
     }