CVE-2026-35465

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35465
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35465.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35465
Aliases
  • GHSA-2jrc-x8fq-prvc
Published
2026-04-18T00:41:16.594Z
Modified
2026-08-12T03:51:09.442387482Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SecureDrop Client has path injection in read_gzip_header_filename()
Details

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.

Database specific 
{
    "cwe_ids": [
        "CWE-36",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35465.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/freedomofpress/securedrop-client

Affected ranges

Type
GIT
Repo
https://github.com/freedomofpress/securedrop-client
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ef014ac5429e813a632fe45e8409c7fbacdc67b2
Fixed
e518adaf897e7838467ccf9e1f28152ae6fe3655
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:freedom:securedrop-client:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.17.5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.7
0.17.0
0.17.0-rc1
0.17.0-rc2
0.17.1
0.17.2
0.17.4
0.4.0
0.4.1
0.5.0
0.6.0-rc1
0.6.0-rc2
0.7.0
0.7.0-rc1
0.7.0-rc2
0.7.0-rc3
0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35465.json"