CVE-2026-28373 - Vulnerability Analysis

Overview

Stackfield Desktop App < 1.10.2 for macOS and Windows contains a path traversal caused by improper handling of the filePath property in decryption functionality, letting attackers write arbitrary files on victim's filesystem, exploit requires crafted malicious export.

Severity & Score

Impact

Attackers can write arbitrary files to any path on the victim's filesystem, potentially leading to system compromise or data tampering.

Mitigation

Update to version 1.10.2 or later.

References

• https://www.rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-traversal-and-arbitrary-file-write-cve-2026-28373/
• https://www.rcesecurity.com/advisories/cve-2026-28373/
• https://www.stackfield.com/desktop-apps

Social Media Activity(1 post)

/r/netsec

@_r_netsec

Mar 25, 2026

Stackfield Desktop App: RCE via Path Traversal and Arbitrary File Write (CVE-2026-28373) https://www.rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-traversal-and-arbitrary-file-write-cve-2026-28373/

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner