slide-maker EUVD-2026-96429

Exploitation requires that an attacker can influence the deck source material consumed by slide-maker so that the generated image-prompt manifest contains '../' path sequences or symlinked filenames, AND that a local victim subsequently runs the generate_images_openai.py image-generation step (the UI:P/user-interaction requirement). It is limited to the local attack vector - there is no direct network-facing entry point - and the victim must actually process attacker-tainted content, so purely trusted, self-authored decks are not at risk. Impact is bounded by the filesystem permissions of the user running the script.

This is a moderate, context-dependent risk rather than an urgent priority. The CVSS 4.0 vector (base score 4.8, Medium) describes a LOCAL attack vector (AV:L) with low complexity (AC:L), no privileges (PR:N), but requiring passive user interaction (UI:P) and yielding only low integrity impact (VI:L) with no confidentiality or availability impact. The attack is not remote: an attacker cannot reach this directly over a network - they must get malicious content into the deck source material that a local user then processes. No EPSS score was provided in the input, the vulnerability is NOT listed in CISA KEV (so not confirmed actively exploited), and no public exploit code is identified - the references are a vendor advisory (VulnCheck), a hackmd technical write-up, and source-line pointers in the GitHub repo, which constitute analysis rather than a weaponized POC. The signals are internally consistent: a local, user-interaction-gated, integrity-only file-write flaw in a niche tool. The main caveat is that CVSS scored only VI:L despite the description noting attackers can 'overwrite existing files at arbitrary paths,' which in some deployments could escalate to code execution or availability loss if a startup script or config is overwritten - verify the realistic blast radius against your deployment.

An attacker influences the source material a victim feeds into slide-maker (for example a shared document, template, or deck outline) so that the generated OpenAI image-prompt manifest contains filenames with '../' sequences or symlinks. When the victim runs generate_images_openai.py, the script writes image files to attacker-chosen paths outside the intended output directory, creating directories and overwriting existing files. No public exploit code is identified at time of analysis; the referenced hackmd write-up and GitHub line pointers are analysis, not a weaponized POC.