CVE-2026-42080: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in icip-cas PPTAgent
CVE-2026-42080 is a medium severity vulnerability in the icip-cas PPTAgent framework that allows arbitrary file write via a path traversal flaw in the save_generated_slides function. This issue affects versions prior to commit 418491a9a1c02d9d93194b5973bb58df35cf9d00 and has been patched in that commit. There are no known exploits in the wild. The vulnerability does not impact confidentiality but can affect integrity and availability due to arbitrary file writes.
AI Analysis
Technical Summary
The vulnerability CVE-2026-42080 in icip-cas PPTAgent is a CWE-22 path traversal issue that allows an attacker with limited privileges and user interaction to write arbitrary files via the save_generated_slides function. This flaw existed in versions before commit 418491a9a1c02d9d93194b5973bb58df35cf9d00 and was fixed by that commit. The CVSS 3.1 base score is 4.6 (medium), reflecting network attack vector, low attack complexity, required privileges, and user interaction. The impact affects integrity and availability but not confidentiality.
Potential Impact
An attacker with limited privileges and requiring user interaction could exploit this vulnerability to write arbitrary files on the system running PPTAgent, potentially modifying or disrupting application behavior or availability. There is no impact on confidentiality. No known exploits have been reported in the wild.
Mitigation Recommendations
This vulnerability has been patched by commit 418491a9a1c02d9d93194b5973bb58df35cf9d00. Users should update PPTAgent to this commit or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch. Patch status is confirmed by the vendor commit reference. No additional mitigation is indicated.
CVE-2026-42080: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in icip-cas PPTAgent
Description
CVE-2026-42080 is a medium severity vulnerability in the icip-cas PPTAgent framework that allows arbitrary file write via a path traversal flaw in the save_generated_slides function. This issue affects versions prior to commit 418491a9a1c02d9d93194b5973bb58df35cf9d00 and has been patched in that commit. There are no known exploits in the wild. The vulnerability does not impact confidentiality but can affect integrity and availability due to arbitrary file writes.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-42080 in icip-cas PPTAgent is a CWE-22 path traversal issue that allows an attacker with limited privileges and user interaction to write arbitrary files via the save_generated_slides function. This flaw existed in versions before commit 418491a9a1c02d9d93194b5973bb58df35cf9d00 and was fixed by that commit. The CVSS 3.1 base score is 4.6 (medium), reflecting network attack vector, low attack complexity, required privileges, and user interaction. The impact affects integrity and availability but not confidentiality.
Potential Impact
An attacker with limited privileges and requiring user interaction could exploit this vulnerability to write arbitrary files on the system running PPTAgent, potentially modifying or disrupting application behavior or availability. There is no impact on confidentiality. No known exploits have been reported in the wild.
Mitigation Recommendations
This vulnerability has been patched by commit 418491a9a1c02d9d93194b5973bb58df35cf9d00. Users should update PPTAgent to this commit or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch. Patch status is confirmed by the vendor commit reference. No additional mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-23T19:17:30.565Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f8d219cbff5d86103970aa
Added to database: 5/4/2026, 5:06:33 PM
Last enriched: 5/4/2026, 5:22:10 PM
Last updated: 5/4/2026, 6:14:33 PM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.