The vulnerability identified as CVE-2026-42078 affects PPTAgent, an agentic framework for reflective PowerPoint generation by icip-cas. Before commit 418491a, the markdown_table_to_image function improperly limited pathname access, enabling an attacker with limited privileges and user interaction to perform arbitrary file writes and create directories outside intended paths (CWE-22: Path Traversal). The vulnerability has been addressed by the referenced commit, which corrects the pathname limitation. The CVSS 3.1 base score is 4.6, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with no confidentiality impact but limited integrity and availability impacts.

Successful exploitation could allow an attacker with limited privileges and user interaction to write arbitrary files and create directories on the affected system, potentially impacting system integrity and availability. There is no confidentiality impact. No known exploits are reported in the wild.

The vulnerability has been patched in commit 418491a. Users should update PPTAgent to this commit or a later version to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch. Patch status is not explicitly stated beyond the commit reference; users should verify the update in their deployment. No additional mitigation steps are indicated.