CVE-2026-88790: proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 is able to address this issue. The name of the patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df. It is suggested to upgrade the affected component. The PoC's candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability - basename-collision fallback - is independent of the parameter name and is confirmed in source.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
proma-ai Proma (File Preview Service)to a version that resolves this vulnerability.Fixed in 0.19.52Patch b7bf78ab74b1552c92fc98c7db9a8a8d92c631df
Event History
Frequently Asked Questions
Which deployments are affected?
Proma versions up to 0.19.37 are affected in the File Preview Service, specifically the resolveTargetPath function in apps/electron/src/main/lib/file-preview-service.ts. Version 0.19.52 addresses the issue.
What level of access does an attacker need?
Exploitation requires local access, low privileges, and user interaction. The attacker manipulates the file_path argument to trigger path traversal through the File Preview Service.
Is there public exploit information?
Yes. A proof of concept has been publicly disclosed, so the issue may be actively usable by attackers with the required local access.
What should teams do if they identify an affected version?
Upgrade to Proma 0.19.52 or later. The identified patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df.
Are older IPC API implementations relevant to assessing exposure?
Yes. The disclosed PoC appears to target version 0.16.3, whose IPC handler accepted raw string-array base paths, while 0.19.52 uses FileAccessOptions and internal getPreviewCandidateBasePaths(). Despite that API difference, the basename-collision fallback underlying the vulnerability is confirmed in source.