CVE-2026-42080

This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00.

The save_generated_slides MCP tool accepts a pptx_path argument and writes the generated PPTX file to that path without any workspace restriction or path validation:

# pptagent/mcp_server.py:288-300
async def save_generated_slides(pptx_path: str):
    """Save the generated slides to a PowerPoint file.

    Args:
        pptx_path: The path to save the PowerPoint file
    """
    pptx = Path(pptx_path)
    assert len(self.slides), (
        "No slides generated, please call `generate_slide` first"
    )
    pptx.parent.mkdir(parents=True, exist_ok=True)   # ← creates arbitrary directories
    self.empty_prs.save(pptx_path)                    # ← writes to arbitrary path

The call to pptx.parent.mkdir(parents=True, exist_ok=True) creates any intermediate directories, and self.empty_prs.save(pptx_path) writes a valid PPTX binary (ZIP archive) to the specified path. No is_relative_to(workspace) check is performed, contrast with download_file in deeppresenter/tools/search.py:290, which correctly enforces workspace confinement.

The server changes directory to WORKSPACE (if set) on startup, so relative paths land in the workspace. Absolute paths, however, reach any filesystem location accessible to the server process.

The concrete attack scenarios include

1. Cron persistence (root-running server): pptx_path = "/etc/cron.d/backdoor" → writes a PPTX ZIP to a path the cron daemon reads; if the ZIP header is misinterpreted, this may corrupt cron or be exploitable depending on parser behaviour.
2. Dot-file overwrite: pptx_path = "/home/user/.bashrc" → overwrites shell init file with a binary blob containing arbitrary content in the PPTX's embedded comments/custom properties.
3. Directory traversal from workspace: pptx_path = "../../.ssh/known_hosts.pptx" → escapes workspace entirely.
4. Denial of service: pptx_path = "/dev/sda" writes to a raw device.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2026-42080 has a CVSS score of 4.6 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.1.36); upgrading removes the vulnerable code path.

Kodem intelligence

The potential fix is something like:

async def save_generated_slides(pptx_path: str):
    workspace = Path(os.getcwd()).resolve()
    target = Path(pptx_path).resolve()
    if not target.is_relative_to(workspace):
        raise ValueError(f"Access denied: path outside workspace: {target}")
    target.parent.mkdir(parents=True, exist_ok=True)
    self.empty_prs.save(str(target))

1. What is CVE-2026-42080? CVE-2026-42080 is a medium-severity path traversal vulnerability in pptagent (pip), affecting versions < 1.1.36. It is fixed in 1.1.36. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2026-42080? CVE-2026-42080 has a CVSS score of 4.6 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of pptagent are affected by CVE-2026-42080? pptagent (pip) versions < 1.1.36 is affected.
4. Is there a fix for CVE-2026-42080? Yes. CVE-2026-42080 is fixed in 1.1.36. Upgrade to this version or later.
5. Is CVE-2026-42080 exploitable, and should I be worried? Whether CVE-2026-42080 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-42080 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-42080? Upgrade pptagent to 1.1.36 or later.