CVE-2026-42080: PPTAgent Path Traversal Vulnerability

CVE-2026-42080 Overview

CVE-2026-42080 is an arbitrary file write vulnerability in PPTAgent, an agentic framework for reflective PowerPoint generation. The flaw exists in the save_generated_slides function and allows authenticated attackers to write files to unintended locations on the host filesystem. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The maintainers patched the issue in commit 418491a by introducing workspace path resolution and restricted evaluation globals.

Critical Impact
Authenticated attackers can write arbitrary files to the host filesystem through the save_generated_slides API, enabling integrity and availability impacts on systems running PPTAgent versions prior to commit 418491a.

Affected Products

PPTAgent (icip-cas/PPTAgent) versions prior to commit 418491a
Deployments exposing the PPTAgent MCP server
Applications integrating the pptagent/apis.py slide generation endpoints

Discovery Timeline

2026-05-04 - CVE CVE-2026-42080 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-42080

Vulnerability Analysis

The vulnerability resides in the save_generated_slides function within PPTAgent's API surface. PPTAgent accepts user-controlled input that is incorporated into a filesystem path without proper validation or normalization. An attacker supplying path traversal sequences or absolute paths can direct the write operation outside the intended workspace directory. This results in arbitrary file write across any location the PPTAgent process can reach.

The patch in commit 418491a introduces a resolve_path_in_workspace helper in pptagent/mcp_server.py. This helper enforces that all generated slide outputs remain inside the configured workspace boundary. The same commit also hardens pptagent/apis.py by defining SAFE_EVAL_GLOBALS = {"__builtins__": {}}, restricting the execution context used during slide rendering.

Root Cause

The root cause is missing path canonicalization in save_generated_slides. User-supplied filename or path components were concatenated with the output directory without verifying the resolved location. Sequences such as ../ or absolute paths were not stripped or rejected, breaking the directory containment assumption.

Attack Vector

Exploitation requires network access to a PPTAgent instance and low-privileged authentication. The attacker submits a slide save request containing a crafted path that escapes the workspace directory. User interaction is required, consistent with typical agentic workflow triggers. Successful exploitation produces files at attacker-chosen locations, potentially overwriting configuration files or planting payloads in startup paths.

python

# Security patch in pptagent/apis.py - commit 418491a
logger = get_logger(__name__)
TABLE_REGEX = re.compile(r".*table_[0-9a-fA-F]{4}\.png$")
SAFE_EVAL_GLOBALS = {"__builtins__": {}}


class SlideRenderer(HTMLRenderer):

python

# Security patch in pptagent/mcp_server.py - commit 418491a
    get_html_table_image,
    get_logger,
    package_join,
    resolve_path_in_workspace,
)

logger = get_logger(__name__)

Source: GitHub Commit 418491a. The patch adds the resolve_path_in_workspace import and a sandboxed evaluation globals dictionary to constrain slide save operations.

Detection Methods for CVE-2026-42080

Indicators of Compromise

Unexpected files written outside the configured PPTAgent workspace directory, particularly .pptx, .html, or .png files in system or user home directories
PPTAgent API requests to save_generated_slides containing ../, ..\, or absolute path prefixes in filename parameters
File modifications in sensitive locations such as ~/.ssh/, ~/.bashrc, cron directories, or web server document roots originating from the PPTAgent process

Detection Strategies

Inspect PPTAgent application logs for slide save operations referencing paths that resolve outside the project workspace
Apply file integrity monitoring on directories adjacent to and above the PPTAgent workspace to catch traversal-based writes
Audit HTTP request bodies sent to PPTAgent endpoints for path traversal patterns prior to forwarding to the application

Monitoring Recommendations

Track the parent process and effective UID of the PPTAgent runtime, then alert on filesystem writes from that process to paths outside its working directory
Forward PPTAgent and MCP server logs to a centralized SIEM and create rules for traversal sequences in API parameters
Monitor the installed PPTAgent commit hash across deployments and flag instances pinned below 418491a

How to Mitigate CVE-2026-42080

Immediate Actions Required

Upgrade PPTAgent to a release containing commit 418491a or later, which introduces resolve_path_in_workspace validation
Restrict network exposure of the PPTAgent MCP server to trusted users and internal networks until patched
Run PPTAgent under a dedicated low-privilege service account with filesystem access limited to its workspace directory

Patch Information

The vulnerability is patched in commit 418491a. Refer to the GitHub Security Advisory GHSA-pxhg-7xr2-w7xg for full advisory details. The fix adds path resolution against the workspace root and isolates evaluation globals.

Workarounds

Deploy PPTAgent inside a container or chroot with read-only mounts on directories outside the intended workspace
Place a reverse proxy in front of PPTAgent that rejects requests containing .., null bytes, or absolute paths in filename fields
Apply mandatory access controls such as AppArmor or SELinux profiles that confine the PPTAgent process to its workspace directory

bash

# Example AppArmor-style confinement to restrict PPTAgent writes to its workspace
/opt/pptagent/workspace/** rw,
deny /etc/** w,
deny /home/*/.ssh/** w,
deny /var/spool/cron/** w,
deny /** w,