CVE-2026-35465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35465", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T19:25:52.193Z", "datePublished": "2026-04-18T00:41:16.594Z", "dateUpdated": "2026-04-20T15:47:43.822Z"}, "containers": {"cna": {"title": "SecureDrop Client has path injection in read_gzip_header_filename()", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-36", "lang": "en", "description": "CWE-36: Absolute Path Traversal", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc"}, {"name": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655", "tags": ["x_refsource_MISC"], "url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655"}, {"name": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8", "tags": ["x_refsource_MISC"], "url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8"}], "affected": [{"vendor": "freedomofpress", "product": "securedrop-client", "versions": [{"version": "< 0.17.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:41:16.594Z"}, "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."}], "source": {"advisory": "GHSA-2jrc-x8fq-prvc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T15:47:29.969249Z", "id": "CVE-2026-35465", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:47:43.822Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35465", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T15:47:29.969249Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:47:38.321Z"}}], "cna": {"title": "SecureDrop Client has path injection in read_gzip_header_filename()", "source": {"advisory": "GHSA-2jrc-x8fq-prvc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "freedomofpress", "product": "securedrop-client", "versions": [{"status": "affected", "version": "< 0.17.5"}]}], "references": [{"url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc", "name": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655", "name": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8", "name": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-36", "description": "CWE-36: Absolute Path Traversal"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:41:16.594Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35465", "state": "PUBLISHED", "dateUpdated": "2026-04-20T15:47:43.822Z", "dateReserved": "2026-04-02T19:25:52.193Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-18T00:41:16.594Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "securedrop-client", "vendor": "freedomofpress", "versions": [{"status": "affected", "version": "< 0.17.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freedom:securedrop-client:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB68D761-3FDD-4FB5-97BC-6D1F150E4C42", "versionEndExcluding": "0.17.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."}, {"lang": "es", "value": "El Cliente SecureDrop es una aplicaci\u00f3n de escritorio para que los periodistas se comuniquen de forma segura con las fuentes y gestionen los env\u00edos en la Estaci\u00f3n de Trabajo SecureDrop. En las versiones 0.17.4 e inferiores, un servidor SecureDrop comprometido puede lograr la ejecuci\u00f3n de c\u00f3digo en la m\u00e1quina virtual del cliente (sd-app) explotando una validaci\u00f3n de nombre de archivo incorrecta en la extracci\u00f3n de archivos gzip, lo que permite rutas absolutas y habilita la sobrescritura de archivos cr\u00edticos como la base de datos SQLite. La explotaci\u00f3n requiere un compromiso previo del servidor SecureDrop dedicado, el cual est\u00e1 reforzado y solo es accesible a trav\u00e9s de servicios ocultos de Tor. A pesar de la alta complejidad del ataque, la vulnerabilidad se clasifica como de severidad Alta debido a su impacto significativo en la confidencialidad, integridad y disponibilidad de los env\u00edos de fuentes descifrados. Este problema es similar a CVE-2025-24888 pero ocurre a trav\u00e9s de una ruta de c\u00f3digo diferente, y se ha implementado una soluci\u00f3n m\u00e1s robusta en la base de c\u00f3digo de reemplazo de la Bandeja de Entrada de SecureDrop. El problema ha sido solucionado en la versi\u00f3n 0.17.5."}], "id": "CVE-2026-35465", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35465", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T15:47:29.969249Z", "version": "2.0.3"}}]}, "published": "2026-04-18T01:16:18.440", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-36"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.17.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "securedrop-client", "source": "cna", "vendor": "freedomofpress"}, "product": "securedrop-client", "vendor": "freedomofpress"}], "analysis": {"en": {"generated_at": "2026-04-18T08:42:07.512850+00:00", "value": {"mitigation_remediation": ["Upgrade the SecureDrop Client to version 0.17.5 or later, which patches the path validation flaw.", "Verify that the SecureDrop Server you connect to is authentic and only via Tor, ensuring the server itself remains uncompromised.", "If immediate upgrade is not possible, monitor and restrict file write operations in the client\u2019s data directory, and consider disabling automatic extraction of gzip archives until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "File path manipulation enabling arbitrary file write and potential code execution"}, "threat_synthesis": {"affected_systems": "The issue affects the freedomofpress:securedrop-client product, specifically versions 0.17.4 and older. Any customer deploying versions prior to 0.17.5 is at risk. The vulnerability was fixed in SecureDrop Client 0.17.5.", "description_and_impact": "SecureDrop Client, used by journalists to download submissions from a SecureDrop Server, contains a flaw in the gzip extraction routine that accepts path names without proper validation. An attacker can supply a gzip archive containing an absolute path or specially crafted filename. When the client extracts the archive, the operating system resolves the path, allowing the attacker to overwrite critical files such as the client\u2019s SQLite database. If the overwrite succeeds, arbitrary code can be executed within the virtual machine that hosts the SecureDrop Client. The vulnerability does not disclose data directly but its impact on confidentiality, integrity and availability of encrypted source submissions is high.", "risk_and_exploitability": "The CVSS score of 7.5 classifies this flaw as High severity. While EPSS is not available, the entry is not listed in CISA KEV, indicating no known widespread exploitation yet. The attack requires prior compromise of the SecureDrop Server, which in turn is hardened and reachable only through Tor hidden services, adding difficulty. Nonetheless, the potential for local code execution on the client\u2019s virtual machine, combined with the high impact on classified submissions, makes the risk significant if the server is breached."}}}}, "created": "2026-04-18T08:45:41.383652+00:00", "updated": "2026-04-20T14:58:57.741343+00:00", "vendors": ["freedomofpress", "freedomofpress$PRODUCT$securedrop-client"]}