The vulnerability in PPTAgent involves improper restriction of file pathnames, allowing an attacker with limited privileges and user interaction to write arbitrary files through the save_generated_slides functionality. This is classified as CWE-22 (Path Traversal). The issue was fixed in commit 418491a, which prevents arbitrary file writes by properly limiting pathnames. The CVSS 3.1 score is 4.6 (medium), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with no confidentiality impact but limited integrity and availability impact.

An attacker with limited privileges and user interaction could exploit this vulnerability to write arbitrary files on the system where PPTAgent is running. This could lead to limited integrity and availability impacts, such as overwriting files or causing denial of service. There is no confidentiality impact reported. No known exploits are currently in the wild.

The vulnerability has been patched in commit 418491a. Users should update PPTAgent to the version including this commit or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch. Patch status is not explicitly confirmed beyond the commit reference; users should verify the vendor repository for the patched version.