---
id: CVE-2026-49136
title: Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py
summary: >-
  Banana Slides through 0.4.0, patched in commit e8bc490, contains a path
  traversal vulnerability in the generate_image() function within the AI service
  backend that allows unauthenticated attackers to read arbitrary image-format
  files out…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: Anionex
product: banana-slides
affected:
  - banana-slides <= 0.4.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-02T15:39:26.996765Z'
exploitAvailable: true
published: '2026-06-01'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:46.786Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49136'
references:
  - url: 'https://github.com/Anionex/banana-slides/issues/429'
  - url: 'https://github.com/Anionex/banana-slides/pull/430'
  - url: >-
      https://github.com/Anionex/banana-slides/commit/e8bc490ec8b4b657e07dc3ab4e94fbedcaade421
  - url: >-
      https://www.vulncheck.com/advisories/banana-slides-path-traversal-via-generate-image-in-ai-service-py
tags:
  - cve.org
  - exploit-available
epss: 0.00417
epssPercentile: 0.36314
ingestedAt: '2026-11-08T14:51:22.393Z'
---

## Overview

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().

## Affected

- `banana-slides <= 0.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.