Is CVE-2026-100676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100676 being exploited in the wild.

How severe is CVE-2026-100676?

High severity, with a CVSS score of 8.2, published 26 September 2026.

Is there a fix for CVE-2026-100676?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100676 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100676?

Check whether you run Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100676: stoatchat January media proxy SSRF via SVG image href

CVE-2026-100676 · Severity: high · CVSS 8.2 · Published 2026-09-26

stoatchat's January media proxy service, which handles embedded media for chat applications, contains a flaw where it improperly processes SVG images. An attacker can craft SVG files to read arbitrary local files from the server, potentially exposing sensitive data like application binaries or configuration files. The vulnerability can also be exploited to cause severe denial of service by forcing the server to read gigabytes of data from disk, exhausting memory and I/O resources.

Technologies: Stoatchat. Vendors: Stoatchat.

Quick answers

Is CVE-2026-100676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100676 being exploited in the wild.
How severe is CVE-2026-100676?: High severity, with a CVSS score of 8.2, published 26 September 2026.
Which products and versions are affected?: Stoatchat before 0.15.5.
Is there a fix for CVE-2026-100676?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100676 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100676?: Check whether you run Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

When fetching a resource served as image/svg+xml, the service resolves SVG <image href> attributes as local filesystem paths rather than treating them as remote references. An unauthenticated attacker can supply a crafted SVG via the /proxy endpoint to trigger arbitrary local file reads. Response-time analysis allows file existence enumeration, and supported image files are leaked after re-encoding; unlimited reads per request cause unbounded I/O and memory consumption (PoC: 4.34 GB reads), resulting in DoS.

Affected products

stoatchat stoatchat before 0.15.5

Timeline

2026-09-26: disclosed: CVE-2026-100676 and GHSA-qv38-hwhv-jm49 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.