{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35465", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T19:25:52.193Z", "datePublished": "2026-04-18T00:41:16.594Z", "dateUpdated": "2026-04-20T15:47:43.822Z"}, "containers": {"cna": {"title": "SecureDrop Client has path injection in read_gzip_header_filename()", "problemTypes": [{"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-36", "lang": "en", "description": "CWE-36: Absolute Path Traversal", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc"}, {"name": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655", "tags": ["x_refsource_MISC"], "url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655"}, {"name": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8", "tags": ["x_refsource_MISC"], "url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8"}], "affected": [{"vendor": "freedomofpress", "product": "securedrop-client", "versions": [{"version": "< 0.17.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:41:16.594Z"}, "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."}], "source": {"advisory": "GHSA-2jrc-x8fq-prvc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T15:47:29.969249Z", "id": "CVE-2026-35465", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:47:43.822Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35465", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T15:47:29.969249Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:47:38.321Z"}}], "cna": {"title": "SecureDrop Client has path injection in read_gzip_header_filename()", "source": {"advisory": "GHSA-2jrc-x8fq-prvc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "freedomofpress", "product": "securedrop-client", "versions": [{"status": "affected", "version": "< 0.17.5"}]}], "references": [{"url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc", "name": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655", "name": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8", "name": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-36", "description": "CWE-36: Absolute Path Traversal"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:41:16.594Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35465", "state": "PUBLISHED", "dateUpdated": "2026-04-20T15:47:43.822Z", "dateReserved": "2026-04-02T19:25:52.193Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-18T00:41:16.594Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freedom:securedrop-client:*:*:*:*:*:*:*:*", "matchCriteriaId": "DB68D761-3FDD-4FB5-97BC-6D1F150E4C42", "versionEndExcluding": "0.17.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."}], "id": "CVE-2026-35465", "lastModified": "2026-04-23T18:31:44.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-18T01:16:18.440", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-36"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.17.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "securedrop-client", "source": "cna", "vendor": "freedomofpress"}, "product": "securedrop-client", "vendor": "freedomofpress"}], "analysis": {"en": {"generated_at": "2026-04-18T08:42:07.512850+00:00", "value": {"mitigation_remediation": ["Upgrade the SecureDrop Client to version 0.17.5 or later, which patches the path validation flaw.", "Verify that the SecureDrop Server you connect to is authentic and only via Tor, ensuring the server itself remains uncompromised.", "If immediate upgrade is not possible, monitor and restrict file write operations in the client\u2019s data directory, and consider disabling automatic extraction of gzip archives until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "File path manipulation enabling arbitrary file write and potential code execution"}, "threat_synthesis": {"affected_systems": "The issue affects the freedomofpress:securedrop-client product, specifically versions 0.17.4 and older. Any customer deploying versions prior to 0.17.5 is at risk. The vulnerability was fixed in SecureDrop Client 0.17.5.", "description_and_impact": "SecureDrop Client, used by journalists to download submissions from a SecureDrop Server, contains a flaw in the gzip extraction routine that accepts path names without proper validation. An attacker can supply a gzip archive containing an absolute path or specially crafted filename. When the client extracts the archive, the operating system resolves the path, allowing the attacker to overwrite critical files such as the client\u2019s SQLite database. If the overwrite succeeds, arbitrary code can be executed within the virtual machine that hosts the SecureDrop Client. The vulnerability does not disclose data directly but its impact on confidentiality, integrity and availability of encrypted source submissions is high.", "risk_and_exploitability": "The CVSS score of 7.5 classifies this flaw as High severity. While EPSS is not available, the entry is not listed in CISA KEV, indicating no known widespread exploitation yet. The attack requires prior compromise of the SecureDrop Server, which in turn is hardened and reachable only through Tor hidden services, adding difficulty. Nonetheless, the potential for local code execution on the client\u2019s virtual machine, combined with the high impact on classified submissions, makes the risk significant if the server is breached."}}}}, "created": "2026-04-18T08:45:41.383652+00:00", "updated": "2026-04-20T14:58:57.741343+00:00", "vendors": ["freedomofpress", "freedomofpress$PRODUCT$securedrop-client"]}