CVE-2026-88790 | proma-ai Proma up to 0.19.37 File Preview Service file-preview-service.ts resolveTargetPath file_path path traversal (Issue 1366)

A vulnerability was found in proma-ai Proma up to 0.19.37 and classified as problematic. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file_path leads to path traversal.

This vulnerability is uniquely identified as CVE-2026-88790. Local access is required to approach this attack. Moreover, an exploit is present.

It is suggested to upgrade the affected component.

The PoC’s candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability – basename-collision fallback – is independent of the parameter name and is confirmed in source.VulDB Recent EntriesRead More