Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
SecureDrop Client: Compromised Server Can Damage Journalist Files
CVE-2026-35465
Summary
SecureDrop Client, used by journalists to communicate with sources, is at risk if the server they rely on is compromised. A hacker could use a security weakness to alter or delete sensitive files. Update to the latest version, 0.17.5, to fix this issue.
Original title
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop ...
Original description
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.
nvd CVSS3.1
7.5
Vulnerability type
CWE-36
CWE-73
Published: 18 Apr 2026 · Updated: 18 Apr 2026 · First seen: 18 Apr 2026