stoatchat before 0.15.5 Local Filesystem Read via SVG
January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-100676
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 03:21 UTC · Revision 1
Source evidence
stoatchat before 0.15.5 Local Filesystem Read via SVG
core-osv · Original sourcePublished 26 Sept 2026, 13:23 UTC
January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.
osv:CVE-2026-100676
Complete source record
{
"id": "ae81f892edad7b97338a0948adee9837b41dc48ed73ac674102cc666999ae7d5",
"url": "https://osv.dev/vulnerability/CVE-2026-100676",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "stoatchat before 0.15.5 Local Filesystem Read via SVG",
"summary": "January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.",
"evidence": "osv:CVE-2026-100676",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-100676",
"aliases": [
"CVE-2026-100676",
"GHSA-qv38-hwhv-jm49"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/stoatchat/stoatchat",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "dc31dd7e62c1f8806b663549700a4121537b9530"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.15.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.15.5"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v0.15.4",
"v0.15.3",
"v0.15.2",
"v0.15.1",
"v0.15.0",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.7",
"v0.13.6",
"v0.13.5",
"v0.13.4",
"v0.13.3",
"v0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.1",
"v0.12.0",
"delete",
"v0.11.5",
"v0.11.4",
"v0.11.3",
"v0.11.2",
"v0.11.1",
"v0.11.0",
"v0.10.3",
"v0.10.2",
"v0.10.1",
"v0.10.0",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"20250923-6",
"20250923-5",
"20250923-3",
"20250923-2",
"20250923-1",
"20250818-1",
"20250807-1",
"20250730-1",
"v0.8.8",
"20250608-1",
"20250530-1",
"20250515-1",
"20250514-1",
"20250513-2",
"20250513-1",
"20250510-1",
"20250509-8",
"20250509-7",
"20250509-6",
"20250509-5",
"20250509-4",
"20250509-3",
"20250509-2",
"20250509-1",
"20250402-2",
"20250402-1",
"20250225-2",
"20250225-1",
"20250224-1",
"20250210-1",
"20241227-2",
"20241227-1",
"20241226-1",
"20241222-6",
"20241222-5",
"20241222-4",
"20241222-3",
"20241222-2",
"20241222-1",
"20241220-1",
"20241213-1",
"20241212-1",
"20241128-3",
"20241128-2",
"20241128-1",
"20241024-1",
"20241002-7",
"20241002-6",
"20241002-5",
"20241002-4",
"20241002-3",
"20241002-2",
"20241002-1",
"20241001-1",
"20240929-3",
"20240929-2",
"20240929-1",
"20240909-2",
"20240909-1",
"20240830-1",
"20240829-3",
"20240829-2",
"20240829-1",
"20240805-1",
"20240710-1",
"20240629-1",
"20240626-1",
"20240625-2",
"20240625-1",
"20240623-1",
"20240621-1",
"20240620-2",
"20240620-1",
"20240619-1",
"20240615-1",
"20240611-3",
"20240611-2",
"20240611-1",
"20240609-1",
"20240604-1",
"20240516-1",
"20240408-4",
"20240408-3",
"20240408-2",
"20240408-1",
"20240407-1",
"20240212-1",
"20240210-2",
"20240210-1",
"20240206-1",
"20231028-2",
"20231028-1",
"20231026-01",
"20230905-1-beta",
"20230903-2-beta",
"20230903-1-beta",
"20230827-3-beta",
"20230827-2-beta",
"20230827-1-beta",
"20230826-1",
"20230810-3",
"20230810-2",
"20230810-1",
"20230704-1",
"20230702-1",
"20230615-1",
"20230611-5",
"20230611-4",
"20230611-3",
"20230611-2",
"20230611-1",
"20230604-1",
"20230603-3",
"20230603-2",
"20230603-1",
"20221119-1",
"20221023-2",
"20221023-1",
"20220918-2",
"20220918-1",
"20220912-1",
"20220903-1",
"20220902-1",
"20220901-1",
"20220814-1",
"20220726-1",
"20220718-1",
"20220715-1",
"0.5.5",
"20220714-1",
"20220710-1",
"0.5.4",
"20220623-1",
"20220621-1",
"20220620-1",
"20220614-1",
"20220612-4",
"20220612-3",
"20220612-2",
"20220612-1",
"20220611-1",
"20220610-2",
"20220610-1",
"20220609-1",
"20220606-1",
"0.5.3-5-patch.3",
"0.5.3-5-patch.2",
"0.5.3-5-patch.1",
"0.5.3-5",
"0.5.3-4",
"0.5.3-3",
"0.5.3-2",
"0.5.3-1",
"0.5.3-patch.2",
"0.5.3-patch.1",
"0.5.3",
"0.5.3-rc.5",
"0.5.3-rc.4",
"0.5.3-rc.3",
"0.5.3-rc.2",
"0.5.3-rc.1",
"0.5.3-alpha.16",
"0.5.3-alpha.15",
"0.5.3-alpha.14",
"0.5.3-alpha.13",
"0.5.3-alpha.11",
"0.5.3-alpha.10",
"0.5.3-alpha.9",
"0.5.3-alpha.8",
"0.5.3-alpha.7",
"0.5.3-alpha.6",
"0.5.0",
"0.4.1",
"0.4.0",
"0.3.3",
"0.3.3-alpha.7",
"0.3.3-alpha.6",
"0.3.3-alpha.5",
"0.3.3-alpha.4",
"0.3.3-alpha.3",
"0.3.3-alpha.2",
"0.3.3-alpha.1",
"0.3.3-alpha.0",
"0.3.2",
"0.3.1",
"0.3.0-rc.0",
"0.3.0",
"0.2.10",
"0.2.9",
"0.2.8",
"0.2.7",
"0.2.6",
"0.2.5",
"0.2.0",
"0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100676.json"
}
}
],
"modified": "2026-10-28T02:30:53.323740703Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100676.json",
"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49",
"https://nvd.nist.gov/vuln/detail/CVE-2026-100676",
"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg"
],
"provider_metadata": {
"cwe_ids": [
"CWE-693"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100676.json"
}
},
"related_cves": [
{
"value": "CVE-2026-100676",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 522160,
"published_at": "2026-09-26T13:23:39.014+00:00"
}