CVE-2026-49136: Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py

Synopsis

Path traversal in Banana Slides 0.4.0 allows an unauthenticated remote attacker to read arbitrary image-format files from the server's filesystem. The flaw is in the generate_image() function in ai_service.py, where a prefix check using os.path.startswith() without a trailing separator fails to confine file access to the intended uploads directory. Successful exploitation lets an attacker read any file that PIL Image.open() can parse outside the uploads directory, including files in sibling directories whose names share the uploads folder prefix. A patched-image rebuild at commit e8bc490ec8b4b657e07dc3ab4e94fbedcaade421 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Banana Slides service via HTTP/HTTPS to supply crafted markdown image references.

• AuthenticationNot required

  No account or credentials are needed; the path traversal is reachable by any unauthenticated request to the generate_image() endpoint.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action such as clicking a link is required for exploitation.

• Attack complexityDetail

  Exploitation is reliable and condition-free; crafting a sibling-directory path that bypasses the prefix check requires no race conditions or special environmental setup.

Blast Radius

• An attacker reads arbitrary image-format files (JPEG, PNG, BMP, and other formats PIL can open) located outside the uploads directory on the server filesystem.
• Files in sibling directories whose names share the uploads folder prefix are directly accessible, including any image-format data stored there such as profile pictures, internal assets, or cached render output.
• If image-format files contain embedded metadata or sensitive content (for example, exported charts with embedded data, screenshots, or credential QR codes), that content is exposed to the attacker without any authentication.