CVE-2026-45242— Summarize < 0.15.1 Path Traversal via slidesDir Parameter
Possible ATT&CK Techniques 1AI
T1059.007 · JavaScriptGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45242
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Summarize < 0.15.1 Path Traversal via slidesDir Parameter
Source: NVD (National Vulnerability Database)
Vulnerability Description
Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45242
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 6567 chars
Paid plan includes:
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-45242
请登录查看更多情报信息。
- https://github.com/steipete/summarize/pull/220issue-tracking
- https://nvd.nist.gov/vuln/detail/CVE-2026-45242
Same Patch Batch · steipete · 2026-05-18 · 5 CVEs total
| CVE-2026-45245 | 7.4 HIGH | Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events |
| CVE-2026-45243 | 6.1 MEDIUM | Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script |
| CVE-2026-45246 | 5.5 MEDIUM | Summarize < 0.15.1 Insecure File Permissions Information Disclosure |
| CVE-2026-45244 | 5.4 MEDIUM | Summarize < 0.15.1 Unapproved Browser Automation Execution |
IV. Related Vulnerabilities
Same product: summarize
- CVE-2026-45246
Summarize < 0.15.1 Insecure File Permissions Information Dis - CVE-2026-45245
Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted - CVE-2026-45244
Summarize < 0.15.1 Unapproved Browser Automation Execution - CVE-2026-45243
Summarize < 0.15.1 Browser Extension Missing Authorization v - CVE-2026-45222
Summarize Insecure Daemon Configuration File Permissions
Same vendor: steipete
- CVE-2026-45246
Summarize < 0.15.1 Insecure File Permissions Information Dis - CVE-2026-45245
Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted - CVE-2026-45244
Summarize < 0.15.1 Unapproved Browser Automation Execution - CVE-2026-45243
Summarize < 0.15.1 Browser Extension Missing Authorization v - CVE-2026-45222
Summarize Insecure Daemon Configuration File Permissions
Same weakness: CWE-862
- CVE-2026-45244
Summarize < 0.15.1 Unapproved Browser Automation Execution - CVE-2026-45243
Summarize < 0.15.1 Browser Extension Missing Authorization v - CVE-2026-5163
Missing authorization check in AI message rewrite endpoint a - CVE-2026-3117
Instance and webhook GitLab plugin commands were able to be - CVE-2026-3637
Mattermost fails to enforce create_post permission when edit
V. Comments for CVE-2026-45242
No comments yet