CVE-2026-45242 is a path traversal vulnerability affecting the steipete summarize product before version 0.15.1. The vulnerability exists in the /v1/summarize daemon endpoint, where authenticated callers can manipulate the slidesDir request parameter to specify absolute or directory traversal paths. This enables attackers to write slide_*.png and slides.json files to any writable directory and delete files matching those patterns, bypassing intended authorization controls. The vulnerability requires authentication but does not require user interaction and has a CVSS 4.0 base score of 7.1, indicating high severity.

An authenticated attacker can write arbitrary files and delete specific files in any writable directory on the system running the summarize daemon. This could lead to unauthorized modification or removal of files, potentially impacting system integrity and availability of data managed by the application or other processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /v1/summarize endpoint to trusted users only and monitor for suspicious activity involving file writes or deletions. Avoid exposing the summarize daemon to untrusted networks.