CVE-2026-28373

CriticalCVSS 9.6

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

35th percentile - higher than 35% of all known CVEs

Summary

The Stackfield Desktop app before version 1.10.2 for macOS and Windows has a path traversal vulnerability in decryption functionality. A malicious export can write arbitrary content to any filesystem path.

Risk Assessment

Attackers can overwrite critical system or application files, leading to code execution or permanent system damage.

Recommendation

Update Stackfield Desktop to version 1.10.2 or later. Do not open untrusted export files.

Original NVD description (English source)

The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem.