Banana Slides through version 0.4.0 contains a path traversal vulnerability in the generate_image() function within its AI service backend. The issue arises from an incomplete directory confinement check that uses os.path.startswith() without a trailing separator, allowing attackers to bypass the restriction by supplying crafted markdown image references. This enables unauthenticated attackers to read arbitrary image-format files located outside the intended uploads directory by accessing sibling directories with names sharing the uploads folder prefix. The vulnerability is exploitable without privileges or user interaction and has a CVSS 4.0 score of 8.7, indicating high severity. No official patch or remediation level has been provided as of the published date.

An unauthenticated attacker can exploit this vulnerability to read arbitrary image files outside the designated uploads directory, potentially exposing sensitive image data. The vulnerability does not require privileges or user interaction and can lead to unauthorized information disclosure. There is no indication of code execution or modification impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is due to an incomplete path prefix check, mitigation would typically involve correcting the path validation logic to properly restrict file access to the intended directory. Until an official fix is released, users should consider restricting access to the affected service or applying custom input validation to prevent exploitation.