PYSEC-2026-2893

### Summary

The `markdown_table_to_image` tool accepts a caller-controlled path parameter and passes it directly to `get_html_table_image`:

```python # pptagent/mcp_server.py:127-143 def markdown_table_to_image(markdown_table: str, path: str, css: str) -> str: """ Args: path (str): The file path where the image will be saved """ html = markdown_to_html(markdown_table) get_html_table_image(html, path, css) # ← no path validation return f"Markdown table converted to image and saved to {path}"

# pptagent/utils.py:337-366 def get_html_table_image(html: str, output_path: str, css: str = None): parent_dir, base_name = os.path.split(output_path) if parent_dir and not os.path.exists(parent_dir): os.makedirs(parent_dir) # ← creates arbitrary directories hti = Html2Image(...) hti.screenshot( html_str=html, css_str=css, save_as=base_name, # ← writes image to any directory size=(1000, 600), ) ```

`os.makedirs(parent_dir)` creates arbitrary directory trees, and `Html2Image.screenshot` writes the rendered image to `parent_dir/base_name`. Unlike `download_file` in the same project, there is no `is_relative_to(workspace)` guard. This behaviour can be fixed with the same pattern as the above.

### Impact

The concrete attack scenarios include

- SSH key replacement: `path = "/home/user/.ssh/authorized_keys"` — replaces the authorized_keys file with an image binary (breaks - SSH but could be an image crafted with a specific PNG/JPEG payload). - Web shell: `path = "/var/www/html/uploads/shell.php"` — writes the rendered PNG there; the file has the .php extension but PNG content; combined with Apache Options +MultiViews or file-include vulnerabilities could be dangerous. - Directory creation oracle: `path = "/root/test/probe.png"` — if the directory is created, confirms the target path exists; if it errors, reveals permissions information.