CVE-2026-100676 stoatchat before 0.15.5 Local Filesystem Read via SVG
Unauthenticated attackers can read local files and cause denial of service via malicious SVGs in stoatchat's media proxy service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100676?
CVE-2026-100676 is a high-severity path traversal vulnerability in stoatchat, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.
Weakness: CWE-693
Which versions are affected by CVE-2026-100676?
How do I fix CVE-2026-100676?
No fix has been published for CVE-2026-100676 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-100676 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100676 exists.
Sources
Also known as GHSA-4h96-wm2q-h7fw, GHSA-qv38-hwhv-jm49.