Which versions of Banana Slides are affected by CVE-2026-49136?

Banana Slides through version 0.4.0 is vulnerable to an unauthenticated path traversal attack allowing remote attackers to read arbitrary image files outside the intended uploads directory, creating…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49136?

Yes, a public proof-of-concept exploit is available for CVE-2026-49136. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-49136?

Within 24 hours: Identify all Banana Slides deployments running version 0.4.0 and apply the patch available per vendor advisory (commit e8bc490 or later) or disable image generation functionality immediately. Within 7 days: Confirm patching is complete across all production and development environments. Within 30 days: Audit system logs and image directories for evidence of unauthorized file access attempts or successful exfiltration during the unpatched period.

Banana Slides CVE-2026-49136

Q: What is the CVSS score of CVE-2026-49136?

CVE-2026-49136 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33753 HIGH

Path Traversal (CWE-22)

2026-06-01 VulnCheck

GHSA-f757-35w9-6h9q

Path Traversal Banana Slides

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 01, 2026 - 21:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 01, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 01, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

Jun 01, 2026 - 20:51 vuln.today

Analysis Generated

Jun 01, 2026 - 20:51 vuln.today

DescriptionCVE.org

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().

AnalysisAI

Path traversal in Banana Slides through 0.4.0 allows unauthenticated remote attackers to read arbitrary image-format files outside the uploads directory via the generate_image() function in the AI service backend. The flaw stems from an incomplete prefix check using os.path.startswith() without a trailing separator, letting sibling directories whose names share the uploads folder prefix bypass containment. Publicly available exploit code exists (GitHub issue #429), and a vendor patch has been released in commit e8bc490.

Technical ContextAI

Banana Slides is a Python-based slide generation application with an AI service backend (backend/services/ai_service.py) that processes user-supplied markdown image references of the form '/files/<path>'. The vulnerable code resolved these references against the configured upload_folder using os.path.abspath() and then validated containment with local_path.startswith(os.path.abspath(upload_folder)). Because the check omitted a trailing path separator, a path like '/uploads_secret/flag.png' satisfies startswith('/uploads') and bypasses confinement - a classic CWE-22 (Path Traversal) instance. The resolved path is then passed to PIL Image.open(), so any file that PIL can decode as an image format is exposed to the attacker through the AI image-generation pipeline.

RemediationAI

Upstream fix available (commit e8bc490 via PR #430); a released patched version beyond 0.4.0 is not independently confirmed, so operators should deploy the fixed commit directly from https://github.com/Anionex/banana-slides/commit/e8bc490ec8b4b657e07dc3ab4e94fbedcaade421 or a build that includes it - the fix replaces the prefix check with os.path.realpath() plus os.path.commonpath() and switches existence check to os.path.isfile(). Until the patched code is deployed, restrict network access to the Banana Slides backend so only trusted users can submit page descriptions or markdown image references, and avoid placing sensitive image-format files in directories whose names share a prefix with the uploads folder (the trade-off is that this only mitigates the specific sibling-prefix variant, not symlink or '..' traversal). Reviewing logs for '/files/' references containing '..' or unexpected sibling paths can help detect exploitation attempts.