Approved changes feed: RSS · Atom

cpe:2.3:a:freedom:securedrop-client:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorFreedom (7e8acd3a-1109-5a5d-8d30-b9700f0d0f12)
ProductSecuredrop Client (1011dd59-b205-5910-ba30-3d949009fc44)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/freedomofpress/securedrop-client purl2cpe 2026-06-01 10:14:03.462769

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-35465 vulnerable 2026-06-08 07:59:14.034210 SecureDrop Client has path injection in read_gzip_header_filename()
HIGH (7.5)
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.
Published: 2026-04-18T00:41:16.594Z
Updated: 2026-04-20T15:47:43.822Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.