A missing authorization vulnerability in the steipete summarize package enables authenticated users to perform path traversal, potentially leading to unauthorized file system access.

This is a Missing Authorization (CWE-862) vulnerability that allows a low-privileged authenticated user to manipulate the slidesdir parameter. This can lead to path traversal, allowing the user to access or manipulate files outside of the intended directory.

The ability to perform path traversal can result in unauthorized reading or manipulation of application files, which may lead to privilege escalation or the exposure of sensitive configuration data. With a CVSS score of 7.1, this vulnerability represents a significant risk to the confidentiality and integrity of the hosting environment.

Immediate Action: Update the npm/@steipete/summarize package to version 0.15.0 or later to ensure proper authorization checks are applied.

Proactive Monitoring: Review application access logs for attempts to use directory traversal sequences (e.g., ../) within the slidesdir parameter.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the filesystem access of the service account to only the directories absolutely necessary for operation.

Public Exploit Available: Unknown.

Administrators should treat this vulnerability with high priority, as it allows authenticated users to break out of their intended storage sandbox. Apply the security update immediately and audit existing user permissions to ensure they follow the principle of least privilege.