Proof-of-Concept Demos

Live exploit walkthroughs of coordinated vulnerability disclosures. Every issue was reported privately to the maintainer and fixed before publication.

PoC — CVE-2026-105080: RCE via calibre .recipe

RCE CVSS 9.9 CWE-94: Code Injection ConvertX ≤ v0.18.0 · Fixed v0.19.0

Registration, upload of a malicious calibre .recipe file, conversion trigger via ebook-convert, root shell inside the container, and JWT_SECRET exfiltration from the process environment.

Environment: the project's default Docker Compose deployment (v0.18.0). The leaked JWT_SECRET is the hardcoded example value from compose.yaml — part of the reported vulnerability.

Full technical analysis → CVE-2026-105080 writeup

Additional RCE PoC demo

Additional remote-code-execution proof-of-concept demo (container breakout / command execution in a vulnerable conversion service).