PT-2026-59530 — Pypi Pptagent

PT-2026-59530 · Pypi · Pptagent

Publicado

2026-07-13

Atualizado

2026-07-13

CVSS v3.1

4.6

Média

Vetor

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Summary

The markdown table to image tool accepts a caller-controlled path parameter and passes it directly to get html table image:

python

# pptagent/mcp server.py:127-143
def markdown table to image(markdown table: str, path: str, css: str) -> str:
  """
  Args:
    path (str): The file path where the image will be saved
  """
  html = markdown to html(markdown table)
  get html table image(html, path, css)      # ← no path validation
  return f"Markdown table converted to image and saved to {path}"

# pptagent/utils.py:337-366
def get html table image(html: str, output path: str, css: str = None):
  parent dir, base name = os.path.split(output path)
  if parent dir and not os.path.exists(parent dir):
    os.makedirs(parent dir)           # ← creates arbitrary directories
  hti = Html2Image(...)
  hti.screenshot(
    html str=html,
    css str=css,
    save as=base name,             # ← writes image to any directory
    size=(1000, 600),
  )

os.makedirs(parent dir) creates arbitrary directory trees, and Html2Image.screenshot writes the rendered image to parent dir/base name. Unlike download file in the same project, there is no is relative to(workspace) guard. This behaviour can be fixed with the same pattern as the above.

Impact

The concrete attack scenarios include

SSH key replacement: path = "/home/user/.ssh/authorized keys" — replaces the authorized keys file with an image binary (breaks - SSH but could be an image crafted with a specific PNG/JPEG payload).
Web shell: path = "/var/www/html/uploads/shell.php" — writes the rendered PNG there; the file has the .php extension but PNG content; combined with Apache Options +MultiViews or file-include vulnerabilities could be dangerous.
Directory creation oracle: path = "/root/test/probe.png" — if the directory is created, confirms the target path exists; if it errors, reveals permissions information.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-2893

Produtos afetados

Pptagent