Stoatchat

An unauthenticated remote attacker can exploit an improper SVG resolution vulnerability in the Stoatchat January media proxy to perform local file enumeration, arbitrary file disclosure, and memory exhaustion via unbounded filesystem I/O.

stoatchat versions prior to 0.15.5 are vulnerable to an authentication bypass where attackers can use their own MFA ticket to authenticate against a victim's session.

stoatchat versions prior to 0.15.0 contain an uncontrolled resource consumption vulnerability in its proxy endpoint that allows unauthenticated attackers to cause memory exhaustion through malicious SVG files.

An unauthenticated, network-accessible Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-63088, exists in stoatchat versions prior to 0.14.0, allowing attackers to bypass DNS-based IP blocklists by exploiting incomplete address validation, potentially leading to unauthorized access to internal network resources.

An unauthenticated server-side request forgery vulnerability, tracked as CVE-2026-63306, exists in stoatchat versions prior to 0.13.5 in the /proxy and /embed endpoints, allowing attackers to enumerate internal services, fingerprint applications, and access instance metadata endpoints, leading to unauthorized information disclosure and potential further compromise of internal infrastructure.