EUVD-2026-75507
GHSA-54xr-9mw4-x7h3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to reach IPC handler; limited file read/write impact within process permissions; no availability impact from traversal alone.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument file_path leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 is able to address this issue. The name of the patch is b7bf78ab74b1552c92fc98c7db9a8a8d92c631df. It is suggested to upgrade the affected component. The PoC's candidateBasePaths parameter name does not match the current IPC API (0.19.52 uses FileAccessOptions with internal getPreviewCandidateBasePaths()). The reporter likely targeted 0.16.3 where the IPC handler accepted raw string[] base paths. The core vulnerability - basename-collision fallback - is independent of the parameter name and is confirmed in source.
AnalysisAI
Path traversal in proma-ai Proma's Electron File Preview Service (versions up to 0.19.37) allows a locally authenticated low-privilege user to escape intended base directories by manipulating the file_path argument passed to resolveTargetPath in file-preview-service.ts. The root cause is a basename-collision fallback that resolves relative traversal sequences outside the allowed candidate base paths, enabling unauthorized reads and potential writes to files accessible by the Electron main process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local authenticated access to the machine running the vulnerable Proma Electron application; (2) a low-privilege user account (PR:L per CVSS 4.0); and (3) passive user interaction - the victim must have an active Proma session (UI:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 0.9 accurately reflects the highly constrained attack surface: local machine access (AV:L), low privileges (PR:L), passive user interaction (UI:P), and limited impact across confidentiality, integrity, and availability (all Low), with no scope change to subsequent systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Proma v0.19.52 or later, which incorporates the fix from commit b7bf78ab74b1552c92fc98c7db9a8a8d92c631df (PR #2030, https://github.com/proma-ai/Proma/pull/2030). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today