CVE-2026-42080

Published: Mag 04, 2026 Last Modified: Mag 04, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low

Description

AI Translation Available

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary file write vulnerability via `save_generated_slides`. This issue has been patched via commit 418491a.

22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9…
https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35c…
https://github.com/icip-cas/PPTAgent/security/advisories/GH…
https://github.com/icip-cas/PPTAgent/security/advisories/GHSA-pxhg-7xr2-w7xg