The Stackfield Desktop App prior to version 1.10.2 for macOS and Windows contains a path traversal vulnerability related to its decryption process. Specifically, when handling the filePath property during a malicious export, the application can be tricked into writing arbitrary data to arbitrary filesystem locations. This could potentially allow an attacker to overwrite or create files anywhere on the victim's system, depending on the privileges of the application. No CVSS score or detailed vendor advisory is available to clarify the full impact or remediation status.

An attacker able to craft a malicious export file could exploit this vulnerability to write arbitrary files to any path on the victim's filesystem. This could lead to unauthorized file modification or creation, potentially enabling further attacks or system compromise depending on the files overwritten and the application's privileges. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when importing or processing export files from untrusted sources. Monitor vendor communications for updates regarding patches or mitigations.