CVE-2026-28373
Published: 03 April 2026
Summary
CVE-2026-28373 is a critical-severity Path Traversal (CWE-22) vulnerability in Stackfield Stackfield. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Stackfield Desktop App versions prior to 1.10.2 for macOS and Windows contains a path traversal vulnerability (CWE-22) in its decryption functionality when processing the filePath property. This flaw allows a malicious export file to write arbitrary content to any path on the victim's filesystem, earning a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability by crafting a malicious export file and tricking a user into opening or processing it within the affected application. Successful exploitation enables arbitrary file writes across the filesystem, potentially leading to remote code execution, data theft, or system compromise depending on the targeted paths and content written.
Advisories from RCE Security detail the vulnerability and its path to RCE, recommending immediate updates to Stackfield Desktop App version 1.10.2 or later to mitigate the issue. The vendor's desktop apps page provides download links for patched versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18801
Vulnerability details
The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability is triggered when a user opens a crafted malicious export file in the desktop app (T1204.002), and the resulting arbitrary file write directly enables client-side code execution (T1203) for RCE or further compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the filePath property in decryption functionality to block path traversal sequences like '../' that enable arbitrary file writes.
Mandates timely remediation of the path traversal flaw by updating to Stackfield Desktop App version 1.10.2 or later.
Enables monitoring of filesystem for unauthorized or anomalous file writes resulting from path traversal exploitation.