Executive brief
stoatchat's January media proxy service, which handles embedded media for chat applications, contains a flaw where it improperly processes SVG images. An attacker can craft SVG files to read arbitrary local files from the server, potentially exposing sensitive data like application binaries or configuration files. The vulnerability can also be exploited to cause severe denial of service by forcing the server to read gigabytes of data from disk, exhausting memory and I/O resources.
Technical details
When fetching a resource served as image/svg+xml, the service resolves SVG <image href> attributes as local filesystem paths rather than treating them as remote references. An unauthenticated attacker can supply a crafted SVG via the /proxy endpoint to trigger arbitrary local file reads. Response-time analysis allows file existence enumeration, and supported image files are leaked after re-encoding; unlimited reads per request cause unbounded I/O and memory consumption (PoC: 4.34 GB reads), resulting in DoS.
Affected products
- stoatchat stoatchat before 0.15.5
Timeline
- 2026-09-26: disclosed: CVE-2026-100676 and GHSA-qv38-hwhv-jm49 published