CVE-2026-100676
Received Received - Intake

Information Disclosure in StoaChat Media Proxy

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100676
EUVD
EUVD-2026-87649

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stoatchat stoatchat to 0.15.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects stoatchat versions before 0.15.5. When an SVG file with an <image href> tag is served as image/svg+xml, the system incorrectly treats the href value as a local filesystem path. An unauthenticated attacker can exploit this by hosting a malicious SVG and using the /proxy endpoint to trigger local file reads. This allows checking for file existence via response-time differences and may disclose supported local image files after re-encoding. The issue also causes excessive filesystem I/O and memory usage, leading to denial of service.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the /proxy endpoint with SVG files containing <image href> tags. Check for unusually large responses or high memory usage on the stoatchat service. Review logs for repeated file reads or access to unexpected local paths.

Impact Analysis

An attacker could determine if specific files exist on your system by measuring response times. They may also access and re-encode supported local image files through the proxy service. Additionally, the vulnerability can consume excessive system resources, causing performance degradation or complete denial of service due to high memory and I/O usage.

Compliance Impact

This vulnerability could lead to unauthorized access to local files, potentially exposing sensitive data. This may violate GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information, depending on the files accessed. Compliance could be impacted if the service handles regulated data.

Mitigation Strategies

Upgrade stoatchat to version 0.15.5 or later immediately. If upgrading is not possible, disable the /proxy endpoint or restrict access to it. Block external SVG files served as image/svg+xml. Monitor system resources for abnormal I/O or memory usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart