A vulnerability in pptagent's markdown_table_to_image function allows an attacker to specify an arbitrary file path for saving images without validation. This can lead to arbitrary directory creation and file write, potentially overwriting sensitive files such as SSH authorized_keys or placing files in web directories with crafted extensions. The issue is fixed in version 1.1.36.