AIKIDO-2026-300739

TL;DR

The command-line interface writes extracted document images into the directory given by --output-dir, deriving each image file extension from the content type declared inside the document. On Windows a content type that contains backslash path segments is used unmodified, so the generated image filename can contain directory separators and traversal segments. Converting a crafted document then writes image files outside the intended output directory. The fix derives the extension by splitting the content type on both forward and back slashes so it can no longer contain path separators.