CVE-2026-108603

Name of the Vulnerable Software and Affected Versions slide-maker versions prior to 5.8.1

Description A path traversal issue exists in the generate images openai.py file. This flaw allows attackers to write image files outside the intended output directory by manipulating filenames provided in the manifest. By influencing the deck source material, an attacker can include symlinked filenames or ../ sequences in the image prompt manifest to create directories and overwrite files at arbitrary paths. This issue has been exploited in real-world incidents.

Recommendations Update slide-maker to a version newer than 5.8.0. Restrict the ability to influence deck source material to prevent the injection of malicious filenames in the manifest.