← Back to the live CVE advisory feed

CVE-2026-100676: stoatchat

Severity

8.8 (HIGH)

Vendor

STOATCHAT

Affected versions

0 through before 0.15.5

Fixed version

0.15.5

Patch status

Patched

Published

2026-09-26T14:16:51.577

Modified

2026-09-26T14:16:51.577

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.

View the official NVD record for CVE-2026-100676

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.