Description

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-20T20:16:54.697Z",
  "pubdate": "2026-09-20T20:16:54.697Z",
  "executiveSummary": "A security vulnerability has been identified in the 06ketan slideshot utility up to version 4.4.0. The flaw is classified as a path traversal vulnerability (CWE-22) located in the render_slides function within the packages/cli/src/renderer.ts component. This vulnerability allows remote attackers to manipulate the htmlPath argument, facilitating unauthorized access to files and directories stored on the file system. Because a public exploit has been disclosed and the project maintainers have not yet released a coordinating patch, the vulnerability poses a significant risk to deployments utilizing affected versions. Remote exploitation requires network access to the vulnerable service but does not appear to require high privileges, making it highly critical for administrators to apply manual mitigations or restrict access to the affected service.",
  "technicalDetails": "The root cause of the vulnerability resides in the lack of input validation and sanitization on the htmlPath parameter within the render_slides function in packages/cli/src/renderer.ts. When the application receives the htmlPath argument, it processes the file path directly to locate and render resources. Due to the absence of proper canonicalization or restriction to a designated root directory, an attacker can input relative path traversal sequences, such as dot-dot-slash (../), to escape the intended directory boundaries.\nDuring exploitation, a remote attacker sends a request targeting the rendering functionality, substituting the expected HTML file path with a manipulated path string targeting sensitive system files (e.g., configuration files, environment variables, or system credentials). The file system API processes this unsanitized path, resolving the relative sequences and accessing the targeted file. The application then attempts to process or return the contents of the retrieved file within the rendering sequence, resulting in arbitrary file disclosure. The impact is elevated if the process runs with administrative or root privileges, as it expands the scope of accessible files beyond standard user restrictions."
}