PT-2026-27771 · Stackfield · Stackfield Desktop App

Julien Ahrens · CVE-2026-28373 · Published 2026-03-25 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stackfield Desktop App versions prior to 1.10.2

Description A path traversal issue exists in the decryption functionality when processing the filePath property. This allows a malicious export to write arbitrary content to any path on the victim's filesystem, which can lead to remote code execution (RCE), a state where an attacker can execute arbitrary commands on the target machine.

Recommendations Update to version 1.10.2 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-28373

Affected Products

Stackfield Desktop App

References · 11

• 🔥 https://rcesecurity.com/advisories/cve-2026-28373 · Exploit
• 🔥 https://rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-traversal-and-arbitrary-file-write-cve-2026-28373 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-28373 · Security Note
• https://twitter.com/_r_netsec/status/2036740645503881429 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040323593062752623 · Twitter Post
• https://t.me/defcon_news/135368 · Telegram Post
• https://t.me/cveNotify/165680 · Telegram Post
• https://stackfield.com/desktop-apps · Note
• https://twitter.com/MrTuxracer/status/2036738656170397863 · Twitter Post
• https://twitter.com/secharvesterx/status/2036775254408745325 · Twitter Post
• https://twitter.com/cyberbivash/status/2040142538661679229 · Twitter Post