stoatchat January CVE-2026-100676

Requires that the target runs the January media proxy/embed service (stoatchat) with a reachable proxy endpoint such as /proxy that will fetch attacker-supplied URLs, and that fetched resources served as image/svg+xml have their SVG <image href> values resolved against the local filesystem - behavior present by default before version 0.15.5. No authentication, user interaction, or non-default configuration is required beyond exposing the proxy endpoint to the attacker (AV:N/PR:N/UI:N). Limiting factors: confidentiality disclosure is constrained to files that decode as supported image formats (re-encoded output) plus a boolean existence/timing oracle; arbitrary text/secret files are not directly readable, and the primary high-severity impact is the unbounded-read denial of service.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.8) describes a genuinely low-friction flaw: network-reachable, no authentication, no user interaction, low attack complexity. The impact split is the key nuance - VC:L (only 'supported local image files' are disclosable after re-encoding, plus a file-existence timing oracle) and VA:H (unbounded reads, ~4.34 GB per the published PoC, exhaust I/O and memory). Integrity is untouched (VI:N). This is a real, actionable priority rather than an inflated score: the DoS primitive is trivially triggerable and unauthenticated, and a working PoC exists. Tempering factors: no EPSS score, no CISA KEV listing, and no evidence of active exploitation were provided, so exploitation should be treated as demonstrated-but-not-yet-observed-in-the-wild. The confidentiality side is limited to image-decodable files and an existence oracle rather than arbitrary text/secret exfiltration, which is why C is Low, not High. Overall: credible, easy-to-abuse DoS plus limited local file disclosure on an internet-facing proxy - patch promptly, but the product's small deployment footprint bounds aggregate risk.

An unauthenticated attacker hosts a malicious SVG containing <image href> values pointing at local filesystem paths and then induces the January media proxy to fetch it via the /proxy endpoint. When the response is served as image/svg+xml, the service resolves those hrefs as local files, letting the attacker use response-timing differences to test file existence and recover supported local image files after re-encoding; the same request can chain many/large reads (~4.34 GB in the published PoC) to exhaust I/O and memory. A public proof of concept exists (publicly available exploit code exists).