CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal
Local attackers can exploit a path traversal vulnerability in the file preview service to read arbitrary files from the host system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-88790?
CVE-2026-88790 is a low-severity path traversal vulnerability in proma-ai Proma, published on 10 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file_path leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 is able to address this issue. The name of the patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df. It is suggested to upgrade the affected component. The PoC's candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability - basename-collision fallback - is independent of the parameter name and is confirmed in source.
Weakness: CWE-22
Which versions are affected by CVE-2026-88790?
How do I fix CVE-2026-88790?
No fix has been published for CVE-2026-88790 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-88790 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88790 exists.
Sources
Also known as GHSA-54xr-9mw4-x7h3.