The path traversal flaw in the generate_images_openai.py script of slide‑maker allows an attacker to write image files to arbitrary locations on the host filesystem. By supplying a prompt manifest that contains filenames with directory traversal sequences such as '../' or symlinked paths, the script can create directories and overwrite existing files outside the intended output folder. This enables an attacker to replace or drop files used by the application or the underlying operating system, potentially leading to privilege escalation or code execution if critical files are overwritten.

The flaw exists in addsumtech slide‑maker versions 5.8.0 and earlier. Any installation of slide‑maker that has not upgraded past 5.8.0 and that processes external prompt manifests via generate_images_openai.py is potentially vulnerable. The vulnerability is tied to the script locations shown in the GitHub source at the mentioned lines.

According to the CVSS base score of 4.8, the vulnerability is classified as moderate severity. Because EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, it is not known to be actively exploited in the wild. Exploitation requires the attacker to control or influence the prompt manifest delivered to the script, which is typically an insider or someone who can feed input to the tool. Therefore the likelihood of exploitation is low to moderate, but an enabled attacker with adequate privileges could write arbitrary files.