CVE-2026-108603: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in addsumtech slide-maker

CVE-2026-108603 is a path traversal vulnerability in addsumtech slide-maker through version 5.8.0. The vulnerability exists in the generate_images_openai.py script, where the application does not properly restrict pathname inputs from the manifest. This allows an attacker who can influence the deck source material to supply filenames containing directory traversal sequences (../) or symlinked paths, enabling writing files outside the designated output directory. This can lead to arbitrary file creation or overwriting on the host filesystem.

An attacker able to control the image prompt manifest can write files outside the intended directory, potentially overwriting existing files or creating new directories arbitrarily. This could lead to unauthorized modification of files on the system where slide-maker is running. The CVSS score of 4.8 (medium severity) reflects the local attack vector and the requirement for user interaction, with limited impact on confidentiality and availability.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or user-supplied deck source material that could contain malicious filenames. Implement input validation or sandboxing to restrict file writes to intended directories.