Proma
Monthly
Path traversal in proma-ai Proma's Electron File Preview Service (versions up to 0.19.37) allows a locally authenticated low-privilege user to escape intended base directories by manipulating the file_path argument passed to resolveTargetPath in file-preview-service.ts. The root cause is a basename-collision fallback that resolves relative traversal sequences outside the allowed candidate base paths, enabling unauthorized reads and potential writes to files accessible by the Electron main process. A public proof-of-concept exists, though it targets the v0.16.3 IPC API and requires adaptation for subsequent pre-fix versions; the underlying vulnerability is confirmed in source code.
Path traversal in proma-ai Proma's Electron File Preview Service (versions up to 0.19.37) allows a locally authenticated low-privilege user to escape intended base directories by manipulating the file_path argument passed to resolveTargetPath in file-preview-service.ts. The root cause is a basename-collision fallback that resolves relative traversal sequences outside the allowed candidate base paths, enabling unauthorized reads and potential writes to files accessible by the Electron main process. A public proof-of-concept exists, though it targets the v0.16.3 IPC API and requires adaptation for subsequent pre-fix versions; the underlying vulnerability is confirmed in source code.