The vulnerability CVE-2026-45242 in steipete summarize prior to version 0.15.1 is a path traversal issue in the /v1/summarize daemon endpoint. Authenticated callers can supply an absolute path or directory traversal sequence in the slidesDir parameter, enabling them to write slide_*.png and slides.json files to arbitrary writable directories and delete matching files by repeated extraction. This allows unauthorized file write and deletion operations outside the intended directory scope. The CVSS 4.0 base score is 7.1 (high severity), with network attack vector, low attack complexity, no user interaction, and high impact on integrity. No official patch or remediation level is currently documented.

An authenticated attacker can write and delete files in arbitrary writable directories on the system running the vulnerable summarize service. This can lead to unauthorized modification or removal of files, potentially impacting system integrity or application behavior. The vulnerability does not indicate direct remote code execution or confidentiality impact but poses a significant integrity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /v1/summarize endpoint to trusted authenticated users only and monitor for unusual file write or deletion activity related to slide_*.png and slides.json files. Avoid running the service with excessive file system permissions to limit potential damage.