CVE-2026-108603 Details

A path traversal vulnerability has been identified in Addsumtech's Slide-Maker application, specifically in versions through 5.8.0. The issue resides within the OpenAI image generation script, generate_images_openai.py. This vulnerability allows attackers to manipulate filenames in the image prompt manifest, creating directories and overwriting files outside the designated output directory. The flaw arises because the script does not properly validate or sanitize manifest-supplied paths before writing image files, enabling unauthorized access to the filesystem.

The vulnerability can be fixed by adding proper path validation in the image generation script. This includes rejecting unsafe filenames, such as those containing traversal sequences or absolute paths, and ensuring that all resolved paths remain within the designated output directory. Additionally, symlink names should be rejected to prevent link following exploits.