PT-2026-27282 · Beeware · Briefcase

CVE-2026-33430 · Publicado 2026-03-23 · Atualizado 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Briefcase versions 0.3.0 through 0.3.25

Description Briefcase, a tool for converting Python projects into standalone native applications, has an issue where the installation process for Windows MSI installers, when set to install for All Users, creates a directory inheriting permissions from its parent. This could allow a low-privilege authenticated user to modify installed binaries. If an administrator subsequently runs these altered binaries, they will execute with elevated privileges. The problem stems from the template used to generate the Windows WXS file.

Recommendations Briefcase versions 0.3.0 through 0.3.25: Re-run briefcase create on your project to utilize the updated templates. Briefcase versions 0.3.24 through 0.3.25: Apply the patch from beeware/briefcase-windows-app-template#86 to your existing Briefcase .wxs file.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2026-33430

GHSA-R3R2-35V9-V238

PYSEC-2026-27

Produtos afetados

Briefcase

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33430.json · Exploit
• https://github.com/beeware/briefcase/security/advisories/GHSA-r3r2-35v9-v238 · Aviso do Fabricante
• https://github.com/beeware/briefcase/issues/2759 · Nota
• https://github.com/beeware/briefcase · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/briefcase/PYSEC-2026-27.yaml · Nota
• https://github.com/beeware/briefcase-windows-app-template/pull/86 · Correção
• https://github.com/beeware/briefcase-windows-VisualStudio-template/pull/85 · Correção
• https://reddit.com/r/VulnMatter/comments/1s2f6l7/resumen_diario_de_vulnerabilidades_24032026 · Publicação no Reddit
• https://osv.dev/vulnerability/PYSEC-2026-27 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33430 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037513427812327879 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-r3r2-35v9-v238 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33430 · Aviso do Fabricante