CVE-2026-35465
SecureDrop Client has path injection in read_gzip_header_filename()
Description
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.
INFO
Published Date :
April 18, 2026, 1:16 a.m.
Last Modified :
Oct. 26, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update SecureDrop Client to version 0.17.5.
- Ensure the SecureDrop Server is hardened.
- Apply SecureDrop Inbox codebase updates.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-35465.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-35465 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-35465
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-35465 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-35465 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: securedrop-client de freedomofpress, Description: El Cliente SecureDrop es una aplicación de escritorio para que los periodistas se comuniquen de forma segura con las fuentes y gestionen los envíos en la Estación de Trabajo SecureDrop. En las versiones 0.17.4 e inferiores, un servidor SecureDrop comprometido puede lograr la ejecución de código en la máquina virtual del cliente (sd-app) explotando una validación de nombre de archivo incorrecta en la extracción de archivos gzip, lo que permite rutas absolutas y habilita la sobrescritura de archivos críticos como la base de datos SQLite. La explotación requiere un compromiso previo del servidor SecureDrop dedicado, el cual está reforzado y solo es accesible a través de servicios ocultos de Tor. A pesar de la alta complejidad del ataque, la vulnerabilidad se clasifica como de severidad Alta debido a su impacto significativo en la confidencialidad, integridad y disponibilidad de los envíos de fuentes descifrados. Este problema es similar a CVE-2025-24888 pero ocurre a través de una ruta de código diferente, y se ha implementado una solución más robusta en la base de código de reemplazo de la Bandeja de Entrada de SecureDrop. El problema ha sido solucionado en la versión 0.17.5. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'freedomofpress', 'product': 'securedrop-client', 'versions': [{'status': 'affected', 'version': '< 0.17.5'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-35465', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-04-20T15:47:29.969249Z'} -
Initial Analysis by [email protected]
Apr. 23, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:freedom:securedrop-client:*:*:*:*:*:*:*:* versions up to (excluding) 0.17.5 Added Reference Type GitHub, Inc.: https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8 Types: Product Added Reference Type GitHub, Inc.: https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc Types: Vendor Advisory -
New CVE Received by [email protected]
Apr. 18, 2026
Action Type Old Value New Value Added Description SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-36 Added CWE CWE-73 Added Reference https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8 Added Reference https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655 Added Reference https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc