Anionex banana-slides up to 0.4.0 AI Service Backend generate_image path traversal

Summaryinfo

A vulnerability was found in Anionex banana-slides up to 0.4.0. It has been rated as critical. Affected is the function generate_image of the component AI Service Backend. Performing a manipulation results in path traversal. This vulnerability was named CVE-2026-49136. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Anionex banana-slides up to 0.4.0. It has been classified as critical. This affects the function generate_image of the component AI Service Backend. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. The summary by CVE is:

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().

The weakness was presented by Yu Sun as 429. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-49136 since 05/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Applying the patch e8bc490ec8b4b657e07dc3ab4e94fbedcaade421 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Anionex

Name

• banana-slides

Version

• 0.1
• 0.2
• 0.3
• 0.4.0

License

• open-source

Website

• Product: https://github.com/Anionex/banana-slides/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion