Slide Maker
Monthly
Path traversal in slide-maker through 5.8.0 lets an attacker who can influence the deck source material cause the image-generation script generate_images_openai.py to write generated image files outside the intended output directory, creating directories and overwriting existing files at arbitrary filesystem paths. The attack is local: a victim must actually run the image-generation step on the tainted deck (UI:P / UI:R), and impact is limited to integrity of files writable by that user, with no confidentiality or availability effect, so purely trusted, self-authored decks are not at risk. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Path traversal in slide-maker through 5.8.0 lets an attacker who can influence the deck source material cause the image-generation script generate_images_openai.py to write generated image files outside the intended output directory, creating directories and overwriting existing files at arbitrary filesystem paths. The attack is local: a victim must actually run the image-generation step on the tainted deck (UI:P / UI:R), and impact is limited to integrity of files writable by that user, with no confidentiality or availability effect, so purely trusted, self-authored decks are not at risk. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.