CVE-2026-42080 is a vulnerability in PPTAgent versions prior to 1.1.36 where the save_generated_slides function allows arbitrary file write due to lack of path validation. The function writes generated PPTX files to user-supplied paths without restricting them to a workspace, enabling directory traversal and overwriting of arbitrary files. This can lead to overwriting critical system files or device nodes. The issue has been fixed in version 1.1.36 by enforcing workspace confinement on file paths.