CVE-2026-88790
Deferred Deferred - Pending Action

Path Traversal in Proma AI

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulDB

Description
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file_path leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 is able to address this issue. The name of the patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df. It is suggested to upgrade the affected component. The PoC's candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability - basename-collision fallback - is independent of the parameter name and is confirmed in source.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88790
EUVD
EUVD-2026-75507

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
proma-ai proma to 0.19.37 (inc)
proma-ai proma 0.19.52

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88790 is a Path Traversal vulnerability in the Proma application up to version 0.19.37. It exists in the resolveTargetPath function of the file-preview-service.ts component. The flaw allows attackers with local access to manipulate file paths via IPC calls, enabling unauthorized read or overwrite operations outside intended directories. The issue stems from the function discarding the full input path and only using the filename to search for files recursively within authorized directories.

Detection Guidance

Detecting this vulnerability requires checking if Proma is running an affected version (up to 0.19.37) and inspecting the file-preview-service.ts component for the resolveTargetPath function. Review IPC calls like file:resolve-and-read and file:write-text for unauthorized path handling. Check logs for path traversal attempts or unexpected file access outside authorized directories.

Impact Analysis

This vulnerability allows attackers with local access to read or overwrite files outside the intended scope of the Proma application. By exploiting path traversal, they could access sensitive data, modify files, or execute unauthorized operations through IPC calls like file:resolve-and-read and file:write-text. The impact includes potential data breaches, unauthorized file changes, and compromise of system integrity.

Compliance Impact

This vulnerability allows unauthorized file read and overwrite operations due to path traversal, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by exposing or altering protected data without authorization.

Mitigation Strategies

Immediately upgrade Proma to version 0.19.52 or later. Ensure strict path validation is enforced in all components handling file paths, including the renderer and main process. Separate preview read-only and edit write IPC permissions. Validate file paths against whitelisted directories in both the renderer and main process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88790. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart