Path Traversal Vulnerability in 06ketan Slideshot Product
CVE-2026-94049

5.3MEDIUM

Key Information:

Vendor: 06ketan
Status: Slideshot
Vendor: CVE Published:; 20 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-94049?

A vulnerability has been identified in the 06ketan Slideshot product, specifically within the render_slides function located in packages/cli/src/renderer.ts. This issue allows for path traversal via the manipulation of an argument called htmlPath, which can lead to unauthorized file access. The vulnerability is exploitable through remote attacks, posing significant risks if not mitigated. Although the issue was reported early to the project maintainers, there has been no response or fix provided yet, leaving users potentially exposed to security threats.

Affected Version(s)

slideshot 4.0

slideshot 4.1

slideshot 4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-94049 - Proof of Concept