CVE-2026-49136

Name of the Vulnerable Software and Affected Versions Banana Slides versions prior to 0.4.0

Description The AI service backend contains a path traversal issue in the generate image() function. This occurs due to an incomplete path prefix check using os.path.startswith() without a trailing separator, which fails to properly confine file access to the intended uploads directory. Unauthenticated attackers can exploit this by providing crafted markdown image references in user-controlled page descriptions. This allows the application to read arbitrary image-format files from sibling directories that share the same prefix as the uploads folder via PIL Image.open().

Recommendations Update Banana Slides to the version containing commit e8bc490. As a temporary mitigation, restrict the use of the generate image() function.