CVE-2026-88790: Path Traversal in proma-ai Proma
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file_path leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 is able to address this issue. The name of the patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df. It is suggested to upgrade the affected component. The PoC's candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability - basename-collision fallback - is independent of the parameter name and is confirmed in source.
AI Analysis
Technical Summary
This vulnerability in proma-ai Proma up to version 0.19.37 allows an attacker with local access to exploit a path traversal flaw in the resolveTargetPath function within the File Preview Service component (apps/electron/src/main/lib/file-preview-service.ts). The flaw arises from improper handling of the file_path argument, enabling directory traversal attacks. The issue was confirmed through public disclosure and proof-of-concept targeting earlier versions such as 0.16.3. The vulnerability is fixed in version 0.19.52 by changes including the patch identified as b7bf78ab74b1552c92fc98c7db9a8a8d92c631df.
Potential Impact
An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing files outside intended directories. The CVSS 4.0 base score is low (2.4), reflecting limited impact and required local privileges. There is no indication of remote exploitation or privilege escalation beyond local access.
Mitigation Recommendations
Upgrade proma-ai Proma to version 0.19.52 or later, where this vulnerability is fixed. The vendor has provided a patch (commit b7bf78ab74b1552c92fc98c7db9a8a8d92c631df) addressing the issue. No other mitigations are indicated or required.
CVE-2026-88790: Path Traversal in proma-ai Proma
Description
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file_path leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 is able to address this issue. The name of the patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df. It is suggested to upgrade the affected component. The PoC's candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability - basename-collision fallback - is independent of the parameter name and is confirmed in source.
CVSS v4.0
Score 2.4low
Affected software
pkg:github/proma-ai/Promacpe:2.3:a:proma-ai:proma:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in proma-ai Proma up to version 0.19.37 allows an attacker with local access to exploit a path traversal flaw in the resolveTargetPath function within the File Preview Service component (apps/electron/src/main/lib/file-preview-service.ts). The flaw arises from improper handling of the file_path argument, enabling directory traversal attacks. The issue was confirmed through public disclosure and proof-of-concept targeting earlier versions such as 0.16.3. The vulnerability is fixed in version 0.19.52 by changes including the patch identified as b7bf78ab74b1552c92fc98c7db9a8a8d92c631df.
Potential Impact
An attacker with local access can exploit this vulnerability to perform path traversal, potentially accessing files outside intended directories. The CVSS 4.0 base score is low (2.4), reflecting limited impact and required local privileges. There is no indication of remote exploitation or privilege escalation beyond local access.
Mitigation Recommendations
Upgrade proma-ai Proma to version 0.19.52 or later, where this vulnerability is fixed. The vendor has provided a patch (commit b7bf78ab74b1552c92fc98c7db9a8a8d92c631df) addressing the issue. No other mitigations are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-10T08:02:40.718Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa2b9afacd9273b4931afc0
Added to database: 09/10/2026, 14:07:43 UTC
Last enriched: 09/10/2026, 14:22:47 UTC
Last updated: 09/10/2026, 15:13:43 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.