PT-2026-27771 · Stackfield · Stackfield Desktop App

Julien Ahrens · Published 2026-03-25 · Updated 2026-04-28 · CVE-2026-28373

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stackfield Desktop App (affected versions not specified)

Description The Stackfield Desktop App is susceptible to Remote Code Execution (RCE) due to a path traversal and arbitrary file write condition. This allows an attacker to potentially execute code on a system by exploiting the way the application handles file paths. The issue involves manipulating file paths to access and write to arbitrary locations on the system, leading to RCE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-28373

Affected Products

Stackfield Desktop App

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-28373 · Security Note
• https://twitter.com/cyberbivash/status/2040142538661679229 · Twitter Post
• https://t.me/defcon_news/135368 · Telegram Post
• https://stackfield.com/desktop-apps · Note
• https://twitter.com/MrTuxracer/status/2036738656170397863 · Twitter Post
• https://twitter.com/_r_netsec/status/2036740645503881429 · Twitter Post
• https://twitter.com/TheHackerWire/status/2040323593062752623 · Twitter Post
• https://rcesecurity.com/2026/03/stackfield-desktop-app-rce-via-path-traversal-and-arbitrary-file-write-cve-2026-28373 · Note
• https://rcesecurity.com/advisories/cve-2026-28373 · Note
• https://twitter.com/secharvesterx/status/2036775254408745325 · Twitter Post