CVE-2026-28373

CriticalCVSS 9.6/10Last modified Jul 24, 2026

Description

The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-traversal-and-arbitrary-file-write-cve-2026-28373/Exploit, Third Party Advisory
https://www.rcesecurity.com/advisories/cve-2026-28373/Exploit, Third Party Advisory
https://www.stackfield.com/desktop-appsProduct

Timeline

Published: Apr 3, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-283744.3Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.CVE-2026-283756.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.CVE-2026-283766.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potential CVE-2026-283777.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing CVE-2026-283782.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public d CVE-2026-283796.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that c CVE-2026-28384.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ para CVE-2026-283806.5Any Editor could delete any snapshot, even if they have no access to read or write them.CVE-2026-283818.1The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/wr CVE-2026-283836.5A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading the entire request body into memory. An CVE-2026-283849.9An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute comma CVE-2026-283855.0In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows auth