CVE-2026-49136 is a path traversal vulnerability in Anionex banana-slides through version 0.4.0. The generate_image() function in the AI service backend improperly limits pathname access due to an incomplete path prefix check using os.path.startswith() without a trailing separator. This allows unauthenticated attackers to craft markdown image references that resolve to sibling directories with names sharing the uploads folder prefix, thereby bypassing directory confinement and causing the application to read arbitrary image-format files outside the intended uploads directory via PIL Image.open(). The vulnerability is fixed in a commit identified as e8bc490.

An unauthenticated attacker can read arbitrary image files outside the designated uploads directory, potentially exposing sensitive image data stored on the server. This can lead to unauthorized disclosure of information. The vulnerability does not require user interaction or privileges and has a high CVSS 4.0 score of 8.7, indicating a significant security risk.

A fix is available and was introduced in commit e8bc490. Users should upgrade banana-slides to a version that includes this patch (versions later than 0.4.0). Since this is not a cloud service, remediation requires applying the patch or upgrading the software. Until patched, avoid exposing the vulnerable service to untrusted users or inputs that could exploit this path traversal.