PT-2026-35811 · Nsa · Grassmarlin
Grady Derosa
·
Published
2026-04-28
·
Updated
2026-04-28
·
CVE-2026-6807
CVSS v3.1
5.5
Medium
| AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Hey all, I have come across Grassmarlin a lot on engagements, so when CISA posted about a newly disclosed vulnerability in the software about 8 hours ago, I got interested. There is no functional POC or whitepaper released, so I'll be the first.
This vulnerability is not really anything crazy, but I will note that phishing attacks with it could lead to exfiltration of arbitrary documents.
It works by targeting the session files (.gm3) and crafting malicious input for them. Once loaded, this POC will exfiltrate data over HTTP connections. The data has to be base64 encoded and chunked to avoid problems that would stop transmission requests.
Overall this is not a severe vulnerability, and there is no real concern here outside of very targeted phishing attacks. I was able to transmit ssh keys through this, just so you are aware. Any network running this should likely be segmented to begin with, mitigating most of the attack vector hopefully. Additionally, phishing is the only real value here, as if you have local machine access you probably have all the access this could give you (unless you convince an admin to run the file after putting it there).
If you have any questions, I'm happy to answer!
Fix
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grassmarlin