CVE-2026-94049
Received Received - Intake

Path Traversal in 06ketan Slideshot

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-21
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94049
EUVD
EUVD-2026-83786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
06ketan slideshot to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the slideshot software up to version 4.4.0. It exists in the render_slides function of the renderer.ts file. The issue allows an attacker to manipulate the htmlPath argument to access files outside the intended directory by using a file:// URL without proper path restrictions. This can lead to arbitrary file reads, exposing sensitive data like /etc/passwd.

Detection Guidance

Check if the slideshot MCP server is running and exposed. Look for processes using render_slides with htmlPath arguments. Inspect network traffic for file:// URL requests to unexpected paths like /etc/passwd. Review logs for unauthorized file access attempts.

Impact Analysis

If you use slideshot version 4.4.0 or earlier, an attacker with access to the MCP interface could exploit this to read sensitive files on your system. This includes configuration files, user data, or system files. The impact depends on the files accessible to the slideshot process and the attacker's privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. If exploited, it may result in data breaches, leading to legal penalties, reputational damage, and loss of trust. Organizations must address this to maintain compliance.

Mitigation Strategies

Disable the MCP server interface if used. Restrict server permissions to least privilege. Implement input validation to reject absolute paths in htmlPath. Use allowlisted directories for file access. Monitor for suspicious file read attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart