PT-2026-60984 · Unknown · Stoat For Android

Monokle · CVE-2026-57848 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stoat for Android (affected versions not specified)

Description Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component, which is accessible to any process on the device via the android.intent.action.SEND intent. The activity accepts a file to share through the android.intent.extra.STREAM extra but fails to validate or filter the incoming URI. This allows a caller to provide a file:// URI pointing to the application's internal storage, such as databases, cached authentication tokens, or preferences. An attacker with the ability to invoke intents on the device can trigger this activity to make the user send internal application files to a chosen channel or user. Because the composer labels the attachment simply as "attachment" without a filename, the user is unaware that internal data is being transmitted. This can lead to the disclosure of message history, contact lists, and authentication tokens, potentially resulting in full account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2026-57848

Affected Products

Stoat For Android

References · 6

• https://github.com/stoatchat/for-android/commit/50d5f5143940809ebb5a61e5f507c956c33aa970 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57848 · Security Note
• https://github.com/stoatchat/for-android · Note
• https://twitter.com/CVEnew/status/2078577956935356635 · Twitter Post
• https://vulncheck.com/advisories/stoat-for-android-internal-file-disclosure-via-exported-sharetargetactivity-uri-validation · Note
• https://twitter.com/infoflowcloud/status/2078579579061404130 · Twitter Post