CVE-2026-49136: Banana Slides Path Traversal Vulnerability – Arbitrary File Read

Technical summary

The vulnerability exists in the generate_image() function of Banana Slides' AI service backend. The application attempts to restrict file access to a designated uploads directory by using os.path.startswith() to validate image paths in user-supplied markdown. However, this check lacks a trailing path separator, creating a bypass: a directory named 'uploads_backup' would pass a startswith('uploads') check even though it is a sibling directory, not a subdirectory of uploads. When PIL's Image.open() is subsequently called on the resolved path, the application reads arbitrary image-format files from unintended locations. The flaw is unauthenticated, accessible via markdown image references in page descriptions, and results in confidentiality loss.

Business impact

An attacker can exfiltrate sensitive image files stored on the same server as the Banana Slides instance without authentication. This may include user-uploaded images, cached assets, system images, or other proprietary visual content. The exposure is particularly concerning for instances hosting confidential diagrams, screenshots, medical imagery, or other sensitive visual data. There is no impact to data integrity or availability, but the confidentiality breach can lead to information disclosure, compliance violations, and reputational harm.

Affected systems

Banana Slides versions 0.4.0 and earlier are vulnerable. The fix was introduced in commit e8bc490, so any deployment updated from that commit forward is patched. Organizations should verify their exact Banana Slides version and check whether their source tree includes the patched commit.

Exploitability

This vulnerability is straightforward to exploit and requires no authentication, special privileges, or user interaction. An attacker simply embeds a crafted markdown image reference in a page description—for example, referencing a sibling directory name that shares the uploads prefix. The application's AI service backend processes the description, generates the image path, and due to the flawed path check, retrieves the file. No CVSS modifiers for attack complexity, privileges, or user interaction apply; the network-based attack surface is direct and accessible to any unauthenticated user.

Remediation

Update Banana Slides to a version that includes the fix from commit e8bc490 or later. Verify the patch by examining the generate_image() function to ensure path validation now includes a trailing path separator (e.g., os.path.join() or explicit separator checks) and properly constrains file access to the intended uploads directory. If an immediate upgrade is not possible, implement network-level controls to restrict access to the Banana Slides instance and disable or restrict the AI image generation feature until patched.

Patch guidance

Apply the patch from commit e8bc490 or later. This commit corrects the path traversal vulnerability in the generate_image() function. After patching, verify that the application no longer accepts crafted markdown image references that resolve to sibling directories. Test with examples such as 'uploads_backup' or 'uploadsX' to confirm the fix prevents bypass. Rebuild and redeploy the application, then confirm in logs that image generation requests now properly reject out-of-bounds paths.

Detection guidance

Monitor application logs for unusual image generation requests, particularly those referencing paths with directory names similar to but distinct from the configured uploads directory (e.g., 'uploads_backup', 'uploadsX'). Search for markdown image references in user-submitted page descriptions that do not conform to expected upload patterns. Check server filesystem access logs for unexpected reads from outside the uploads directory initiated by the Banana Slides process. Implement alerting on failed PIL Image.open() calls or path validation errors in the AI service logs to catch exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.5), unauthenticated attack vector, and direct confidentiality impact. The flaw is trivial to exploit—requiring only crafted markdown input—and affects all versions up to 0.4.0. While the CISA KEV list has not yet included this CVE, the combination of ease of exploitation, zero authentication requirement, and broad applicability makes it a priority for rapid remediation. Organizations should treat this as urgent unless they can confirm they are running a patched version.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an unauthenticated network-based attack (AV:N/PR:N), low attack complexity (AC:L), no user interaction (UI:N), high confidentiality impact (C:H), and no integrity or availability impact (I:N/A:N). The score appropriately captures the ease and accessibility of the attack but does not account for real-world mitigating factors such as network segmentation, restricted deployment contexts, or the limited value of image files in particular environments. Security teams should use this score as a baseline and adjust local risk rating based on the sensitivity of image data stored in their Banana Slides instances.

Frequently asked questions