| शीर्षक | 06ketan slideshot 4.4.0 Path Traversal |
|---|
| विवरण | An arbitrary file read vulnerability (CWE-22) has been identified in the render_slides MCP tool of 06ketan slideshot 4.4.0, commit 57d5895a97f10a7e9658d953eaa399bd6085f141. The tool accepts an attacker-controlled htmlPath argument, resolves it to an absolute path, and loads it through a file:// URL without enforcing a trusted workspace or base-directory boundary. An attacker with access to the MCP interface can therefore make the server render arbitrary local files readable by the server process into an output document, potentially exposing sensitive information. A working exploit has been demonstrated by rendering /etc/passwd into a PDF. No fixed version is available at the time of reporting. |
|---|
| स्रोत | ⚠️ https://github.com/06ketan/slideshot/issues/18 |
|---|
| उपयोगकर्ता | Xh1Xxhg (UID 90906) |
|---|
| सबमिशन | 27/08/2026 08:28 AM (24 दिन पहले) |
|---|
| संयम | 19/09/2026 11:48 PM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407978 [06ketan slideshot तक 4.4.0 renderer.ts render_slides htmlPath निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|