CVE-2026-28373

Published: Apr 03, 2026 Last Modified: Apr 03, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem.

22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
https://www.rcesecurity.com/2026/03/stackfield-desktop-app-…
https://www.rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-travers…
https://www.rcesecurity.com/advisories/cve-2026-28373/
https://www.rcesecurity.com/advisories/cve-2026-28373/
https://www.stackfield.com/desktop-apps
https://www.stackfield.com/desktop-apps