CVE-2026-41308

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41308", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T14:01:46.670Z", "datePublished": "2026-05-08T14:30:37.513Z", "dateUpdated": "2026-05-11T18:54:15.811Z"}, "containers": {"cna": {"title": "Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication", "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "lang": "en", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c"}, {"name": "https://github.com/pglombardo/PasswordPusher/pull/4381", "tags": ["x_refsource_MISC"], "url": "https://github.com/pglombardo/PasswordPusher/pull/4381"}, {"name": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4", "tags": ["x_refsource_MISC"], "url": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4"}], "affected": [{"vendor": "pglombardo", "product": "PasswordPusher", "versions": [{"version": "< 1.69.3", "status": "affected"}, {"version": ">= 2.0.0-a, < 2.4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T14:30:37.513Z"}, "descriptions": [{"lang": "en", "value": "Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2."}], "source": {"advisory": "GHSA-qfh8-f79c-x86c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-11T18:53:41.927769Z", "id": "CVE-2026-41308", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:54:15.811Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41308", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:53:41.927769Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-11T18:54:04.239Z"}}], "cna": {"title": "Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication", "source": {"advisory": "GHSA-qfh8-f79c-x86c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "pglombardo", "product": "PasswordPusher", "versions": [{"status": "affected", "version": "< 1.69.3"}, {"status": "affected", "version": ">= 2.0.0-a, < 2.4.2"}]}], "references": [{"url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c", "name": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pglombardo/PasswordPusher/pull/4381", "name": "https://github.com/pglombardo/PasswordPusher/pull/4381", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4", "name": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T14:30:37.513Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41308", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:54:15.811Z", "dateReserved": "2026-04-20T14:01:46.670Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T14:30:37.513Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "PasswordPusher", "vendor": "pglombardo", "versions": [{"status": "affected", "version": "< 1.69.3"}, {"status": "affected", "version": ">= 2.0.0-a, < 2.4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*", "matchCriteriaId": "A40E5A4E-1B5D-436B-954C-79A0581B60AC", "versionEndExcluding": "1.69.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*", "matchCriteriaId": "B501892C-3C3A-45D0-814B-68F0E35097BF", "versionEndExcluding": "2.4.2", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2."}, {"lang": "es", "value": "Password Pusher es una aplicaci\u00f3n de c\u00f3digo abierto para comunicar informaci\u00f3n sensible a trav\u00e9s de la web. Antes de las versiones 1.69.3 y 2.4.2, un problema de seguridad en OSS PasswordPusher permit\u00eda la creaci\u00f3n no autenticada de env\u00edos de tipo archivo a trav\u00e9s de una ruta de creaci\u00f3n gen\u00e9rica de la API JSON bajo ciertas configuraciones. Esto podr\u00eda eludir el l\u00edmite de autenticaci\u00f3n previsto para la creaci\u00f3n de env\u00edos de archivos. Este problema ha sido parcheado en las versiones 1.69.3 y 2.4.2."}], "id": "CVE-2026-41308", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41308", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-11T18:53:41.927769Z", "version": "2.0.3"}}]}, "published": "2026-05-08T15:16:39.480", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/pglombardo/PasswordPusher/pull/4381"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.69.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-a,2.4.2)"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "PasswordPusher", "source": "cna", "vendor": "pglombardo"}, "product": "password_pusher", "vendor": "pglombardo"}], "created": "2026-05-08T16:00:13.269112+00:00", "updated": "2026-05-14T20:00:14.051250+00:00", "vendors": ["pglombardo", "pglombardo$PRODUCT$password_pusher"]}