Authenticated Path Traversal Enables Arbitrary File Write

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Summarize prior to version 0.15.1 contains a critical path traversal vulnerability in its /v1/summarize daemon endpoint that allows authenticated users to write files to arbitrary directories on the system. By injecting directory traversal sequences (such as `../`) or absolute paths into the slidesDir request parameter, attackers can bypass intended file restrictions and place slide_*.png and slides.json files anywhere the application has write permissions. This vulnerability matters because it transforms a seemingly benign summarization feature into a file system manipulation tool—attackers can overwrite critical application files, inject malicious content into web-accessible directories, or corrupt data integrity. Organizations running Summarize versions before 0.15.1 with exposed endpoints are at risk, particularly in environments where multiple users or services interact with the API.

Casky.ai's 261 mapped security skills detect the attack patterns underlying this CVE by analyzing behaviors aligned with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Defense Evasion). Practitioners using Casky would identify suspicious findings such as: unexpected absolute path parameters in API request logs, repeated writes to directories outside the application's intended scope, and patterns of file creation followed by deletion that match the vulnerability's exploitation chain. Claude's extended reasoning capabilities help correlate seemingly isolated file I/O events into coherent attack narratives—recognizing when path traversal sequences appear in input validation gaps, when file system permissions are being abused post-authentication, and when file deletion patterns suggest cleanup of artifacts. Security teams would see findings highlighting the risk of insufficient input sanitization on the slidesDir parameter and the need for version upgrades combined with access controls limiting who can invoke the /v1/summarize endpoint.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45242.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-45242

Casky has 261 skills that investigate the attack patterns behind CVE-2026-45242. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn