January, the media proxy/embed service of stoatchat, before version 0.15.5, improperly resolves SVG <image href> values as local filesystem paths when serving image/svg+xml content. This allows an unauthenticated remote attacker to probe for local file existence via timing differences and disclose local image files after re-encoding. The vulnerability can also cause unbounded local filesystem I/O and memory pressure, leading to denial of service. The issue is fixed in version 0.15.5.