PT-2026-33546 · Unknown · Securedrop Client

Published 2026-04-18 · Updated 2026-04-19 · CVE-2026-35465

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SecureDrop Client versions prior to 0.17.5

Description Improper filename validation during gzip archive extraction allows a compromised SecureDrop Server to achieve code execution on the Client virtual machine (sd-app). This occurs because the system permits absolute paths, enabling the overwriting of critical files such as the SQLite database.

Recommendations Update to version 0.17.5.

Fix

Weakness Enumeration

CWE-73

CWE-36

Related Identifiers

CVE-2026-35465

Affected Products

Securedrop Client

References · 6

• https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc · Vendor Advisory
• https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35465 · Security Note
• https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8 · Note
• https://twitter.com/TheRabbitPy/status/2045783085443096868 · Twitter Post
• https://twitter.com/CVEnew/status/2045467336996508066 · Twitter Post