The vulnerability is a directory traversal flaw in the decryption logic that handles the filePath property of exported files. When the Stackfield Desktop App processes a crafted export with a specially formatted filePath, the application writes the export’s content to an arbitrary location on the host file system. This allows an attacker to create or overwrite any file, including system binaries or configuration files, thereby compromising the integrity and potentially the availability of the compromised machine.

Stackfield Desktop App versions prior to 1.10.2 on both macOS and Windows are affected. Versions 1.10.2 and later are not vulnerable.

With a CVSS score of 9.6 the flaw is considered critical. No EPSS score is available, and it is not yet listed in the CISA KEV catalog. The likely attack path requires an attacker to supply a malicious export file that the victim opens or imports. This is inferred from the description, as the vulnerability is triggered by processing the filePath property during export handling. Given that the ability to deliver the malicious export is sufficient for exploitation, the vulnerability is highly exploitable with low complexity.