EUVD-2026-33753
GHSA-f757-35w9-6h9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Banana Slides instance ≤ 0.4.0
-
DeliverySubmit page description with crafted /files/../sibling-dir/img.png reference
-
ExploitBypass startswith() prefix check
-
ExecutionPIL Image.open() reads target file
-
ImpactImage content returned via AI generation pipeline
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or user interaction is required (CVSS PR:N/UI:N/AV:N/AC:L); the attacker only needs network reach to a Banana Slides instance running version ≤ 0.4.0 with the AI image-generation feature enabled and reachable input fields (page descriptions or markdown image references that flow into generate_image()). Exploitation is limited to reading files that PIL can decode as an image (PNG, JPEG, GIF, TIFF, etc.) and that reside in a directory whose absolute path begins with the same prefix string as the configured upload_folder - for example, if uploads is '/var/app/uploads', then '/var/app/uploads_secret/' or '/var/app/uploads.bak/' are reachable, but unrelated paths like '/etc/passwd' are not (this variant does not yield arbitrary-file-read of text files). |
| Impact | CVSS 4.0 scores this 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N and VC:H (high confidentiality impact, no integrity or availability impact), reflecting network-reachable, unauthenticated, low-complexity exploitation that leaks file contents. Publicly available exploit code (GitHub issue #429 and PR #430) elevates real-world risk, and the issue was reported by VulnCheck, indicating analyst-grade triage. The vulnerability is not listed in CISA KEV and no EPSS score was provided, so widespread automated exploitation is not confirmed; given Banana Slides' relatively small deployment footprint, exploitation is plausible but likely opportunistic rather than mass-scale. The impact is bounded - only files PIL can open as images are leaked, not arbitrary text/source code - which somewhat constrains the practical blast radius compared to a generic arbitrary-file-read. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a page description containing a crafted markdown image reference such as '/files/../uploads_secret/flag.png' (or any sibling directory whose name shares the 'uploads' prefix). The AI service resolves this path, the flawed startswith() check passes, and PIL Image.open() reads the targeted image-format file and incorporates it as a reference image, leaking its contents back through the image-generation flow. A public PoC is available in the linked GitHub issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Path traversal in Banana Slides through 0.4.0 allows unauthenticated remote attackers to read arbitrary image-format files outside the uploads directory via the generate_image() function in the AI service backend. The flaw stems from an incomplete prefix check using os.path.startswith() without a trailing separator, letting sibling directories whose names share the uploads folder prefix bypass containment. Publicly available exploit code exists (GitHub issue #429), and a vendor patch has been released in commit e8bc490.
Earlier versions of this analysis (2)
Path traversal in Banana Slides through 0.4.0 lets remote unauthenticated attackers read arbitrary image-format files outside the uploads directory by embedding crafted markdown image references in page descriptions. The flaw stems from a defective os.path.startswith() prefix check that treats sibling directories sharing the uploads-folder name prefix (e.g. uploads_secret/) as in-scope, and publicly available exploit code exists via the VulnCheck advisory and the upstream GitHub issue/PR.
Path traversal in Banana Slides through 0.4.0 lets unauthenticated remote attackers read arbitrary image-format files outside the uploads directory by abusing the generate_image() function in the AI service backend. The flaw stems from an incomplete prefix check using os.path.startswith() without a trailing separator, allowing sibling directories that share the uploads folder name prefix to bypass confinement. Publicly available exploit code exists via the project's GitHub issue tracker, and a vendor patch has been released in commit e8bc490.
RemediationAI
Upstream fix available (commit e8bc490 via PR #430); a released patched version beyond 0.4.0 is not independently confirmed, so operators should deploy the fixed commit directly from https://github.com/Anionex/banana-slides/commit/e8bc490ec8b4b657e07dc3ab4e94fbedcaade421 or a build that includes it - the fix replaces the prefix check with os.path.realpath() plus os.path.commonpath() and switches existence check to os.path.isfile(). Until the patched code is deployed, restrict network access to the Banana Slides backend so only trusted users can submit page descriptions or markdown image references, and avoid placing sensitive image-format files in directories whose names share a prefix with the uploads folder (the trade-off is that this only mitigates the specific sibling-prefix variant, not symlink or '..' traversal). Reviewing logs for '/files/' references containing '..' or unexpected sibling paths can help detect exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Banana Slides is a Python-based slide generation application with an AI service backend (backend/services/ai_service.py) that processes user-supplied markdown image references of the form '/files/<path>'. The vulnerable code resolved these references against the configured upload_folder using os.path.abspath() and then validated containment with local_path.startswith(os.path.abspath(upload_folder)). Because the check omitted a trailing path separator, a path like '/uploads_secret/flag.png' satisfies startswith('/uploads') and bypasses confinement - a classic CWE-22 (Path Traversal) instance. The resolved path is then passed to PIL Image.open(), so any file that PIL can decode as an image format is exposed to the attacker through the AI image-generation pipeline.
Know when Banana Slides gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().
Executive ViewAI
Banana Slides through version 0.4.0 is vulnerable to an unauthenticated path traversal attack allowing remote attackers to read arbitrary image files outside the intended uploads directory, creating direct risk of sensitive data disclosure. Publicly available exploit code exists, meaning internet-facing deployments face active exploitation risk. Organizations must patch immediately to prevent unauthorized access to proprietary visual assets and confidential content.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB