| Title | 06ketan slideshot 4.4.0 Path Traversal |
|---|
| Description | An arbitrary file read vulnerability (CWE-22) has been identified in the render_slides MCP tool of 06ketan slideshot 4.4.0, commit 57d5895a97f10a7e9658d953eaa399bd6085f141. The tool accepts an attacker-controlled htmlPath argument, resolves it to an absolute path, and loads it through a file://example.com/etc/passwd into a PDF. No fixed version is available at the time of reporting. |
|---|
| Source | ⚠️ https://github.com/06ketan/slideshot/issues/18 |
|---|
| User | Xh1Xxhg (UID 90906) |
|---|
| Submission | 08/27/2026 08:28 (2 months ago) |
|---|
| Moderation | 09/19/2026 23:48 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 407978 [06ketan slideshot up to 4.4.0 renderer.ts render_slides htmlPath path traversal] |
|---|
| Points | 20 |
|---|