[Security] Path Traversal / Zip Slip in PackURI and _DirPkgReader / _ZipPkgWriter

[himel-atik]

Security Vulnerability Report

Hello @scanny,

I am reaching out to responsibly disclose a path traversal
vulnerability I discovered in python-pptx. I have already
initiated a CVE request with MITRE (CAN-2026-2031972).

Summary

python-pptx's PackURI class does not reject '../' sequences,
allowing path traversal via _DirPkgReader and Zip Slip via
_ZipPkgWriter when processing a malicious .pptx file.

Affected Files

• pptx/opc/packuri.py (PackURI.new)
• pptx/opc/serialized.py (_DirPkgReader.getitem, _ZipPkgWriter.write)

Impact

• Arbitrary file read outside the package directory
• Zip Slip: writing files outside the intended directory

Vulnerability Type

• CWE-22: Path Traversal
• CWE-23: Zip Slip

Affected Versions

All versions through 1.0.2 (latest)

Remediation Suggested

1. Reject '../' sequences in PackURI.new
2. Add os.path.normpath() check in _DirPkgReader.getitem
3. Sanitize member names in _ZipPkgWriter.write()

Disclosure Timeline

• [16/06/2026] - Vulnerability discovered
• [16/06/2026] - GitHub issue opened (no SECURITY.md found)
• [16/06/2026] - CVE request submitted to MITRE (CAN-2026-2031972)
• 90 days from today - Public disclosure if no patch is released

I have a full proof-of-concept and detailed technical write-up
available. I am happy to share privately if you can provide
a secure contact channel (email or GitHub Security Advisory).

I would appreciate acknowledgment of this report within
7 days. If I do not hear back, I will proceed with public
disclosure after the 90-day window.

Discovered by: MD Himel Atik