CVE-2026-42078: PPTAgent Path Traversal Vulnerability

CVE-2026-42078 Overview

CVE-2026-42078 affects PPTAgent, an agentic framework for reflective PowerPoint generation. The vulnerability allows arbitrary file write and directory creation through the markdown_table_to_image function. An authenticated attacker can leverage the flaw to write files outside the intended workspace using crafted path inputs. The maintainers patched the issue in commit 418491a by introducing workspace path resolution and a restricted evaluation context. The flaw is categorized as a path traversal weakness [CWE-22].

Critical Impact
Authenticated attackers can write arbitrary files and create directories on the host running PPTAgent, potentially leading to integrity loss and limited availability impact.

Affected Products

PPTAgent (icip-cas/PPTAgent) prior to commit 418491a
Deployments using pptagent/apis.py with unrestricted markdown_table_to_image
Deployments using pptagent/mcp_server.py without workspace path resolution

Discovery Timeline

2026-05-04 - CVE-2026-42078 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-42078

Vulnerability Analysis

PPTAgent processes markdown tables and renders them as images through the markdown_table_to_image helper. Prior to commit 418491a, the function accepted user-controlled paths without resolving them against an allowed workspace directory. The handler also evaluated expressions using a permissive globals environment. Together, these issues let an attacker direct file writes to locations outside the intended output directory and trigger the creation of arbitrary directories on the host filesystem.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The code did not normalize or validate path arguments, and it allowed evaluation against unrestricted built-ins. Without canonicalization or sandboxing, traversal sequences and absolute paths reached filesystem APIs unchecked.

Attack Vector

Exploitation requires network access to the PPTAgent service and low-privileged authenticated input, with user interaction in the rendering workflow. An attacker submits markdown content referencing a manipulated table image path. The server resolves the path during rendering and writes the generated artifact to an attacker-chosen location, creating intermediate directories as needed.

python

# Security patch in pptagent/apis.py
 logger = get_logger(__name__)
 TABLE_REGEX = re.compile(r".*table_[0-9a-fA-F]{4}\.png$")
+SAFE_EVAL_GLOBALS = {"__builtins__": {}}


 class SlideRenderer(HTMLRenderer):

# Security patch in pptagent/mcp_server.py
     get_html_table_image,
     get_logger,
     package_join,
+    resolve_path_in_workspace,
 )

 logger = get_logger(__name__)
# Source: https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00

The patch introduces SAFE_EVAL_GLOBALS to neutralize Python built-ins during evaluation and adds resolve_path_in_workspace to constrain file operations to the workspace root.

Detection Methods for CVE-2026-42078

Indicators of Compromise

Unexpected .png files matching the pattern table_[0-9a-fA-F]{4}.png written outside the configured PPTAgent workspace directory.
New directories created by the PPTAgent process user in system locations such as /etc, /var, or user home directories.
PPTAgent request logs containing markdown table inputs with absolute paths or ../ traversal sequences.

Detection Strategies

Audit filesystem activity from the PPTAgent service account and alert on writes outside the declared workspace path.
Inspect HTTP request bodies sent to PPTAgent endpoints for path traversal patterns in fields that feed markdown_table_to_image.
Compare deployed PPTAgent commit hashes against 418491a to identify hosts running vulnerable code.

Monitoring Recommendations

Forward PPTAgent application logs and host filesystem telemetry to a central analysis pipeline for correlation.
Track creation of files matching the table image regex outside expected output paths and alert on anomalies.
Monitor for process creation or interpreter calls originating from the PPTAgent worker that touch sensitive directories.

How to Mitigate CVE-2026-42078

Immediate Actions Required

Upgrade PPTAgent to a build that includes commit 418491a or later.
Restrict the PPTAgent service account to a dedicated, least-privileged workspace directory.
Limit network exposure of the PPTAgent API and MCP server to trusted, authenticated clients only.

Patch Information

The maintainers fixed the issue in commit 418491a of the icip-cas/PPTAgent repository. The patch adds resolve_path_in_workspace for path containment and defines SAFE_EVAL_GLOBALS with empty __builtins__ to harden evaluation. Refer to the GitHub Security Advisory GHSA-hrcw-xc63-g29m for advisory details.

Workarounds

Run PPTAgent inside a container or chroot that confines writes to a non-sensitive directory.
Apply mandatory access control profiles (AppArmor, SELinux) to deny writes outside the workspace.
Place a reverse proxy in front of PPTAgent that strips traversal sequences and absolute paths from markdown inputs.

bash

# Configuration example: confine PPTAgent writes with systemd
[Service]
ReadWritePaths=/var/lib/pptagent/workspace
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true