EUVD-2026-83786
GHSA-j3p4-767v-v66w
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Real-world risk is LOW despite the network-flagged 5.3 CVSS 4.0 score. slideshot is an obscure open-source TypeScript/Node CLI tool (packages/cli/src/renderer.ts), and the vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N marks impact as confidentiality-only-Low with no integrity or availability effect - consistent with a path traversal that yields limited arbitrary file read, not code execution. The exploit maturity is E:P (proof-of-concept) and a public exploit exists via the project's GitHub issue #18, so 'publicly available exploit code exists' - but this is NOT active exploitation: no CISA KEV listing and no EPSS score are provided. Key conflict: the description asserts 'the attack is possible to be carried out remotely' and the vector uses AV:N, yet this is a locally-invoked CLI whose vulnerable input (htmlPath) is a command argument - VulDB routinely inflates such CLI issues to AV:N. Verify with vendor/usage context: unless slideshot is wrapped in a server that passes untrusted htmlPath values, the realistic vector is local (AV:L). Sole source is VulDB with an unresponsive maintainer and no patch, further capping practical urgency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Path traversal in 06ketan slideshot through 4.4.0 allows manipulation of the htmlPath argument in the render_slides function of packages/cli/src/renderer.ts, enabling low-impact confidentiality exposure via traversal outside the intended rendering path. The CVSS 4.0 vector indicates network reachability, low privileges required (PR:L), and only low confidentiality impact (VC:L), which supports the independent assessment of LOW real-world risk despite the 5.3 score. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the project was reportedly notified through an issue but has not responded.
RemediationAI
No vendor-released patch was identified at time of analysis; the upstream project was reportedly notified through GitHub issue #18 but had not responded in the provided data. Until a fixed version is available, avoid passing untrusted or user-controlled htmlPath values to render_slides; if the CLI must process templates, canonicalize the resolved path and enforce that it remains within an approved render directory, and reject absolute paths or any path containing ../ sequences. Because this is a CLI package, run slideshot with least privilege in a restricted container or sandbox that exposes only the intended template and output directories, accepting the trade-off of reduced filesystem flexibility and potential breakage of legitimate workflows that rely on external files. Monitor https://github.com/06ketan/slideshot/issues/18 and the repository for a patched release before deploying in environments where untrusted input reaches htmlPath.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-22 path traversal in the TypeScript/Node.js slideshot CLI package, specifically in the render_slides function in packages/cli/src/renderer.ts. The htmlPath argument is user-controllable and is not sufficiently neutralized before being used in file operations, allowing sequences such as ../ to escape the intended directory. The affected product is represented by CPE cpe:2.3:a:06ketan:slideshot:*:*:*:*:*:*:*:*, which maps to the 06ketan slideshot project; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) limits impact to low confidentiality, with no integrity or availability loss. Because PR:L is present, the vector indicates low-privileged access rather than an unauthenticated attack. Exploit code is public, matching the E:P metric.
Know when Slideshot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB