CVE-2026-35465

{
  "id": "CVE-2026-35465",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T01:16:18.440",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5."
    },
    {
      "lang": "es",
      "value": "El Cliente SecureDrop es una aplicación de escritorio para que los periodistas se comuniquen de forma segura con las fuentes y gestionen los envíos en la Estación de Trabajo SecureDrop. En las versiones 0.17.4 e inferiores, un servidor SecureDrop comprometido puede lograr la ejecución de código en la máquina virtual del cliente (sd-app) explotando una validación de nombre de archivo incorrecta en la extracción de archivos gzip, lo que permite rutas absolutas y habilita la sobrescritura de archivos críticos como la base de datos SQLite. La explotación requiere un compromiso previo del servidor SecureDrop dedicado, el cual está reforzado y solo es accesible a través de servicios ocultos de Tor. A pesar de la alta complejidad del ataque, la vulnerabilidad se clasifica como de severidad Alta debido a su impacto significativo en la confidencialidad, integridad y disponibilidad de los envíos de fuentes descifrados. Este problema es similar a CVE-2025-24888 pero ocurre a través de una ruta de código diferente, y se ha implementado una solución más robusta en la base de código de reemplazo de la Bandeja de Entrada de SecureDrop. El problema ha sido solucionado en la versión 0.17.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "freedomofpress",
          "product": "securedrop-client",
          "versions": [
            {
              "version": "< 0.17.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T15:47:29.969249Z",
          "id": "CVE-2026-35465",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-36"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:freedom:securedrop-client:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.17.5",
              "matchCriteriaId": "DB68D761-3FDD-4FB5-97BC-6D1F150E4C42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}