{"id":"EUVD-2026-30797","revision":"7fc5ddfb558d4a77828e11d4456eb5a9","records":[{"revision":"7fc5ddfb558d4a77828e11d4456eb5a9","observedAt":"2026-10-28T06:10:51.969+00:00","statement":{"source":"euvd","id":"EUVD-2026-30797","aliases":["CVE-2026-45242","GHSA-8jr4-6r33-phwm"],"title":"Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence i…","description":"Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":7.1,"severity":null}],"references":["https://github.com/steipete/summarize/releases/tag/v0.15.2","https://github.com/steipete/summarize/pull/220","https://github.com/steipete/summarize/commit/ec8efd63295656fbfe8743620179c489bc5a242f","https://www.vulncheck.com/advisories/summarize-path-traversal-via-slidesdir-parameter"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30797","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 18, 2026, 6:52:08 PM","dateUpdated":"Oct 8, 2026, 3:22:45 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30797","identifiers":["EUVD-2026-30797","CVE-2026-45242","GHSA-8jr4-6r33-phwm"]},"retained":false,"historicalAffected":[]}],"coverage":[]}