CVE-2026-41308

{
  "id": "CVE-2026-41308",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T15:16:39.480",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2."
    },
    {
      "lang": "es",
      "value": "Password Pusher es una aplicación de código abierto para comunicar información sensible a través de la web. Antes de las versiones 1.69.3 y 2.4.2, un problema de seguridad en OSS PasswordPusher permitía la creación no autenticada de envíos de tipo archivo a través de una ruta de creación genérica de la API JSON bajo ciertas configuraciones. Esto podría eludir el límite de autenticación previsto para la creación de envíos de archivos. Este problema ha sido parcheado en las versiones 1.69.3 y 2.4.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pglombardo",
          "product": "PasswordPusher",
          "versions": [
            {
              "version": "< 1.69.3",
              "status": "affected"
            },
            {
              "version": ">= 2.0.0-a, < 2.4.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T18:53:41.927769Z",
          "id": "CVE-2026-41308",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.69.3",
              "matchCriteriaId": "A40E5A4E-1B5D-436B-954C-79A0581B60AC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.4.2",
              "matchCriteriaId": "B501892C-3C3A-45D0-814B-68F0E35097BF"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/pglombardo/PasswordPusher/pull/4381",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}