TL;DR
- Multiple CVEs in 2025-2026 (Gotenberg SSRF, ConvertX path traversal) and an FBI warning reveal security risks in online file conversion tools
- Uploaded files are typically retained for 1–24 hours, potentially used for analysis/AI training; CDN caches and logs make residual copies harder to control
- Three-step assessment: check processing method (local vs. cloud), read the privacy policy, and see if registration is required
- For sensitive files, prioritize tools that process locally in the browser (WebAssembly) — data never leaves your device
You type "PDF to Word" into a search engine, click the top free tool, upload a contract, upload a resume, hit convert, and download the file. The whole process takes under two minutes — super convenient.
But have you ever wondered: where did that contract you just uploaded actually go?
In that moment you click "Convert," most people hand over their sensitive files to a website whose server location, maintainers, and data retention policies are a complete mystery.
This isn't fear-mongering. Between 2025 and 2026, multiple security incidents and official warnings have pulled back the curtain on the online file conversion industry.
The Sins of Online File Converters, Past and Present
Case 1: Gotenberg API Vulnerability (CVE-2026-55229)
A high-severity flaw (CVSS 7.5). Before version 8.34.0, the widely used conversion API Gotenberg had a serious issue: an attacker could trigger SSRF and file disclosure just by uploading a crafted document — no authentication required.
Case 2: ConvertX Path Traversal (CVE-2025-66449, CVE-2026-24741)
Two high-severity vulnerabilities were disclosed in the self-hosted conversion tool ConvertX. Attackers could overwrite system files or delete arbitrary files on the server via path traversal. Your files sit on a backend riddled with holes.
Case 3: 2024 PDF Tool Leaks Thousands of User Documents
Two online PDF converters misconfigured their cloud storage, exposing thousands of user documents — including passports and contracts — to public access. No hack, just a configuration mistake.
The FBI issued a warning in March 2025: Online document converters are being used to spread malware. Attackers set up fake "PDF Candy" phishing sites that inject info-stealers into converted files. These sites rank high in search results through paid ads.
Kaspersky's 2025 report: In the first 10 months of 2024 alone, 111 million web threats were detected globally, with free file conversion sites being a major attack vector.
What Actually Happens to Your Uploaded File?
Online conversion typically follows five steps: select file → upload to cloud → server-side conversion → download → delayed server deletion. Every step can go wrong.
Upload to cloud: The file travels from your device to the provider's server, passing through multiple network nodes where it could be intercepted.
Server-side storage: Files are usually retained for 1–24 hours (ILovePDF 1–24h, CloudConvert up to 24h). During that time, they may be used to "improve service quality" — analyzing data, training AI. Some privacy policies say "uploaded content may be used in anonymized form." Translation: your file could be sold to a third party.
Delayed deletion: Even if they promise deletion after 24 hours, copies can linger for months in CDN caches and log backups. The 2024 leak happened precisely because "deleted" files were still sitting on a misconfigured cloud storage bucket.
Three blind spots you'll never know: Which server is your file on? Who has access to it? When is it actually deleted?
Three Steps to Judge Whether a File Converter Is Safe
Step 1: Check the processing method (most important)
Where is the file processed — server-side or client-side?
- ❌ Uploaded to a server: your file leaves your control
- ✅ Processed locally in the browser: your file never leaves your device
Step 2: Read the privacy policy
Look for three keywords:
- "Data retention period" — is there a specific timeframe, or is it vague?
- "Data sharing" — do they explicitly say they don't share, or is it "may be used to improve services"?
- "Deletion mechanism" — can you actively delete uploaded files?
Step 3: Check if registration is required
Tools that require an account may just be collecting your email and usage habits.
The safest option:
Choose tools that process files locally in the browser. Using WebAssembly technology, the file is handled entirely on your device — no network transfer, and memory is automatically cleared when done. For sensitive files like contracts, IDs, and financial statements, this is the only way to guarantee no data leaks.
Conclusion: Convenience Shouldn't Come at a Cost
Online file conversion seems trivial, but one careless upload can lead to leaked contracts, exposed privacy, or even compliance violations.
You don't need to become a security expert. Just remember three rules:
Use local-only tools for sensitive files.
Read the last three paragraphs of any privacy policy before using an online tool.
If a free service feels too good to be true, ask yourself where the money comes from.
Spending 30 seconds to vet a tool is far cheaper than spending months cleaning up a data breach.
