Arbitrary File Write and Directory Creation in PPTAgent Framework
CVE-2026-42078

4.6MEDIUM

Key Information:

Vendor

Icip-cas

Status
Pptagent
Vendor
CVE Published:
4 May 2026

What is CVE-2026-42078?

PPTAgent, a framework designed for reflective PowerPoint generation, previously harbored a vulnerability that allowed for arbitrary file writes and directory creation through its markdown_table_to_image function. This flaw was addressed in commit 418491a. Users of earlier versions are encouraged to update their installations to mitigate risks associated with this issue.

Affected Version(s)

PPTAgent < 418491a9a1c02d9d93194b5973bb58df35cf9d00

References

https://github.com/icip-cas/PPTAgent/security/advisories/...
x_refsource_CONFIRM
https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02...
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.