CVE-2026-42078CWE-22

PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image

Medium · published May 4, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image. This issue has been patched via commit 418491a.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00302 · 21.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-04T16:55Z
EPSS history
Timeline
  • 04 MAY 16:55Z
    PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image
    cvelistv5