Presenton CVE-2026-120192

Requires the Presenton Electron desktop build (PRESENTON_ELECTRON=true), which in versions up to 0.9.11-beta runs its internal Next.js/FastAPI HTTP servers with DISABLE_AUTH=true and no per-launch credential; an attacker reaching that server requests paths under /app_data that fall outside the intended asset subdirectories (images, uploads, exports, pptx-to-html, pptx-to-json, fonts, templates) to read configuration, databases, logs, export-task JSON and other private application files. LIMITING FACTORS: only the desktop/Electron deployment mode is affected; the HTTP servers are loopback/internal services, so real reachability likely depends on a co-located local client or a browser-based cross-origin/cross-port path rather than arbitrary internet access; only versions ≤0.9.11-beta are affected (0.9.12-beta scopes the served directories, enforces a .txt-only document reader, and gates access behind a desktop session token/cookie).

This is a medium-severity information-disclosure flaw (CWE-200) in the Presenton Electron desktop app's authentication middleware, carrying a CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/PR:N/UI:N and confidentiality-only impact (VC:L). The vuln.today decision label is 'this_month' - a moderate, scheduled-remediation priority, not act_now or emergency. Exploit maturity is E:P (Proof-of-Concept): a public PoC reference exists (GitHub issue #973) but it is not verified as working exploit code, and this CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. No EPSS probability was supplied in the input, so widespread-exploitation likelihood cannot be quantified here. A key conflict: the CVSS vector asserts a network attack vector (AV:N) and no privileges (PR:N), but the affected component is an Electron desktop app whose internal HTTP servers (Next.js + FastAPI) run on loopback with DISABLE_AUTH=true - the fix's handling of cross-port/cross-origin fetches and cookie scoping implies the realistic threat is a local client or a browser-based cross-origin vector rather than an arbitrary remote network attacker. Verify the true reachability (loopback vs. exposed) with the vendor before treating this as internet-remote. Net: a legitimate but not emergency priority - a real confidentiality bug in a niche product, with a PoC that is unverified and no confirmed in-the-wild use.

An attacker able to reach the Presenton desktop app's internal loopback HTTP server - which in affected versions runs without login (DISABLE_AUTH=true) and without the per-launch credential added in the fix - issues requests to the /app_data endpoint for file paths outside the intended asset subdirectories, retrieving configuration, databases, logs, export-task JSON, or other private application files. A public PoC reference exists (GitHub issue #973) but is not verified as working exploit code, so weaponization effort is unconfirmed. The exact trigger (direct request vs. browser cross-origin/DNS-rebinding path) is not fully described in the available sources.