Executive brief
Stackfield is an end-to-end encrypted collaboration platform used by organizations to manage sensitive data. A security flaw in its desktop application for Windows and macOS allows a malicious user to create a specially crafted data export that, when decrypted by another user, can write files to any location on the victim's computer. This could allow an attacker to gain full control over the victim's system by placing malicious files in sensitive locations like the Startup folder.
Technical details
A path traversal vulnerability exists in the Stackfield Desktop App (before 1.10.2) within the `DecryptBackup()` function. The application processes the `filePath` and `fileGuid` properties from an export's room JSON file without proper sanitization. By crafting a `filePath` that contains traversal sequences (e.g., `../`) and a matching `fileGuid` to bypass internal string replacement logic, an attacker can manipulate the destination path passed to `addLocalFile()`. This allows the attacker to write arbitrary decrypted content to sensitive filesystem locations outside the intended export directory. Exploitation requires the victim to manually attempt to decrypt a malicious export provided by the attacker, which can lead to Remote Code Execution (RCE) by overwriting system files or placing scripts in startup directories.
Affected products
- Stackfield Stackfield Desktop App < 1.10.2
Timeline
- 2026-02-17: disclosed: Vulnerability discovered by RCE Security
- 2026-03-03: patched: Vendor released version 1.10.2 fixing the issue
- 2026-03-23: advisory: Public disclosure by RCE Security
- 2026-04-03: other: CVE published to NVD