Loading story…
Banana Slides through version 0.4.0 is affected by a path traversal flaw in backend/services/ai_service.py that allows unauthenticated attackers to read arbitrary image-format files from unintended directories on the server. The bug, tracked as CVE-2026-49136 and classified as CWE-22, stems from using os.path.startswith() without a trailing path separator to enforce confinement to the uploads directory. In the default Docker deployment, where UPLOAD_FOLDER=/app/uploads, an attacker could submit a crafted markdown image reference in a page description and access sibling paths such as /app/uploads_secret because they share the same string prefix.
The vulnerable generate_image() flow resolves the attacker-controlled /files/ path and passes it to PIL Image.open(), enabling arbitrary file reads before the AI API call runs. Public reporting showed the issue also affected v0.3.0 at a different line number, and a proof-of-concept used a reference like:
The project fixed the issue in commit e8bc490 after merging pull request #430, changing the validation to require the trusted upload path plus os.sep so the check enforces real directory containment rather than a simple prefix match; the advisory rates the bug CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
VulnCheck published an advisory describing the path traversal flaw in Banana Slides through version 0.4.0 and explained that the bug stemmed from an incomplete directory confinement check in generate_image(). The advisory also stated the issue had been patched in commit e8bc490.
CVE-2026-49136 was published for a path traversal vulnerability affecting Banana Slides through version 0.4.0. The entry described unauthenticated arbitrary image-file reads via crafted markdown references and noted the issue was patched in commit e8bc490.
A commit showed the code change tightening path validation in generate_image() so resolved paths must start with the upload folder path plus the OS path separator. This change was intended to block unauthorized file access before opening images from disk.
A security fix for the unsafe startswith() directory check in backend/services/ai_service.py was merged into main as commit 82d870f. The remediation appended the path separator to enforce real directory containment and included a security test for the traversal guard.
A GitHub issue disclosed an arbitrary file read/path traversal vulnerability in Banana Slides v0.4.0, and noted the issue also affects v0.3.0. The report described how unauthenticated attackers could use crafted /files markdown image references to access image-format files in sibling directories sharing the uploads prefix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Infinite Image Browsing fixed two related path validation flaws that could let remote attackers read files outside intended directories in deployments exposed through Stable Diffusion WebUI. The issues, tracked as **CVE-2026-77814** and **CVE-2026-77815**, affect versions through **1.8.0** and stem from the `is_path_trusted()` logic in `scripts/iib/api.py` and path resolution in `scripts/iib/tool.py`. One bug used a naive `startswith(parent_path)` check, allowing prefix-collision bypasses such as trusted `/data/images` matching `/data/images_private`; the other relied on `os.path.normpath()`, which failed to resolve symlinks and enabled escapes from scanned directories to disclose readable files such as `/etc/passwd`. The project merged a fix in pull request **#969** and commit `4057a624c7a23a36f0b4dc6a545b40767d602450`, replacing `os.path.normpath()` with `os.path.realpath()` and tightening validation to require the trusted parent path plus a trailing separator. The patch also ensures resolved paths are used for file serving, addressing **CWE-22** and **CWE-59**. The original report noted that some standalone configurations had `enable_access_control = False` by default, while network-exposed WebUI modes such as `share`, `ngrok`, `listen`, or `server_name` could automatically enable access control and therefore depend on the flawed confinement checks.
Aug 21, 2026
A critical path traversal flaw tracked as **`CVE-2026-56260`** allows unauthenticated remote attackers to write arbitrary files on servers running vulnerable versions of **Crawl4AI**. The issue affects the Docker API server’s **`/screenshot`** and **`/pdf`** endpoints, where the **`output_path`** parameter accepts absolute paths and directory traversal sequences without proper validation. The vulnerability impacts versions up to and including **`0.8.6`** and was fixed in **`0.8.7`**. By overwriting files writable by the application user, attackers could cause denial of service and compromise system integrity, including planting SSH authorized keys or injecting cron jobs for persistence. The flaw is classified as **`CWE-22`** and carries a **CVSS 9.1** rating with network-based, unauthenticated exploitation potential. Reports said no public proof-of-concept or confirmed active exploitation had emerged at publication time, and advised organizations to upgrade immediately or restrict access to the exposed endpoints as a compensating control.
Jul 13, 2026
OpenBMB ChatDev through version **2.2.0** is affected by **`CVE-2026-58166`**, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the `POST` uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into `save_upload_file` without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations. The issue is rated **CVSS 3.1 9.1 (Critical)**, with a listed **CVSS 4.0 8.8 (High)**, and is considered remotely exploitable without authentication. The flaw was fixed in commit **`4fd4da6`**, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.
Jul 1, 2026