CVE-2026-100676

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-100676

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100676.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-100676

Aliases

GHSA-qv38-hwhv-jm49

Published

2026-09-26T13:23:39Z

Modified

2026-09-28T03:48:31Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

stoatchat before 0.15.5 Local Filesystem Read via SVG

Details

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100676.json"
}

References

Affected packages

Git / github.com/stoatchat/stoatchat

Affected ranges

Type

GIT

Repo

https://github.com/stoatchat/stoatchat

Events

Introduced

Fixed

dc31dd7e62c1f8806b663549700a4121537b9530

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.15.5"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*

0.1.0

0.2.0

0.2.10

0.2.5

0.2.6

0.2.7

0.2.8

0.2.9

0.3.0

0.3.0-rc.0

0.3.1

0.3.2

0.3.3

0.3.3-alpha.0

0.3.3-alpha.1

0.3.3-alpha.2

0.3.3-alpha.3

0.3.3-alpha.4

0.3.3-alpha.5

0.3.3-alpha.6

0.3.3-alpha.7

0.4.0

0.4.1

0.5.0

0.5.3

0.5.3-1

0.5.3-2

0.5.3-3

0.5.3-4

0.5.3-5

0.5.3-5-patch.1

0.5.3-5-patch.2

0.5.3-5-patch.3

0.5.3-alpha.10

0.5.3-alpha.11

0.5.3-alpha.13

0.5.3-alpha.14

0.5.3-alpha.15

0.5.3-alpha.16

0.5.3-alpha.6

0.5.3-alpha.7

0.5.3-alpha.8

0.5.3-alpha.9

0.5.3-patch.1

0.5.3-patch.2

0.5.3-rc.1

0.5.3-rc.2

0.5.3-rc.3

0.5.3-rc.4

0.5.3-rc.5

0.5.4

0.5.5

Other

20220606-1

20220609-1

20220610-1

20220610-2

20220611-1

20220612-1

20220612-2

20220612-3

20220612-4

20220614-1

20220620-1

20220621-1

20220623-1

20220710-1

20220714-1

20220715-1

20220718-1

20220726-1

20220814-1

20220901-1

20220902-1

20220903-1

20220912-1

20220918-1

20220918-2

20221023-1

20221023-2

20221119-1

20230603-1

20230603-2

20230603-3

20230604-1

20230611-1

20230611-2

20230611-3

20230611-4

20230611-5

20230615-1

20230702-1

20230704-1

20230810-1

20230810-2

20230810-3

20230826-1

20230827-1-beta

20230827-2-beta

20230827-3-beta

20230903-1-beta

20230903-2-beta

20230905-1-beta

20231026-01

20231028-1

20231028-2

20240206-1

20240210-1

20240210-2

20240212-1

20240407-1

20240408-1

20240408-2

20240408-3

20240408-4

20240516-1

20240604-1

20240609-1

20240611-1

20240611-2

20240611-3

20240615-1

20240619-1

20240620-1

20240620-2

20240621-1

20240623-1

20240625-1

20240625-2

20240626-1

20240629-1

20240710-1

20240805-1

20240829-1

20240829-2

20240829-3

20240830-1

20240909-1

20240909-2

20240929-1

20240929-2

20240929-3

20241001-1

20241002-1

20241002-2

20241002-3

20241002-4

20241002-5

20241002-6

20241002-7

20241024-1

20241128-1

20241128-2

20241128-3

20241212-1

20241213-1

20241220-1

20241222-1

20241222-2

20241222-3

20241222-4

20241222-5

20241222-6

20241226-1

20241227-1

20241227-2

20250210-1

20250224-1

20250225-1

20250225-2

20250402-1

20250402-2

20250509-1

20250509-2

20250509-3

20250509-4

20250509-5

20250509-6

20250509-7

20250509-8

20250510-1

20250513-1

20250513-2

20250514-1

20250515-1

20250530-1

20250608-1

20250730-1

20250807-1

20250818-1

20250923-1

20250923-2

20250923-3

20250923-5

20250923-6

delete

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.12.0

v0.12.1

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.13.4

v0.13.5

v0.13.6

v0.13.7

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.15.4

v0.8.8

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100676.json"