Local Filesystem Exposure in Stoatchat Media Proxy Service

CVE-2026-100676

What is CVE-2026-100676?

The Stoatchat media proxy service prior to version 0.15.5 contains a weakness in handling SVG values, allowing an unauthorized remote attacker to exploit the /proxy endpoint. By forcing the service to fetch an SVG hosted on a malicious server, the attacker can infer the existence of local files based on response times and potentially exfiltrate sensitive data. Additionally, this flaw could lead to Denial of Service due to excessive local filesystem reads, causing significant resource strain on the server, as demonstrated by a proof of concept that consumes around 4.34 GB in reads. The issue has been addressed in version 0.15.5.

References