Apple CVE-2026-28373

The vulnerability exists in the file decryption and export processing logic of Stackfield Desktop App. When the application decrypts exported data, it fails to properly validate and sanitize the filePath property before using it to write decrypted content to disk. This path traversal flaw allows an attacker to use directory traversal sequences (such as ../ or absolute paths) to write files outside the intended application directory to arbitrary locations on the victim's filesystem. The affected technology spans both the macOS and Windows versions of the desktop application, indicating a platform-agnostic implementation flaw in the file handling code. The vulnerability can be exploited through specially crafted export files that contain malicious filePath values during the decryption process.