Improper Filename Validation Vulnerability in SecureDrop Client by Freedom of the Press

CVE-2026-35465

What is CVE-2026-35465?

The SecureDrop Client, designed for journalists to securely interact with sources, has a vulnerability that allows a compromised SecureDrop Server to execute arbitrary code on the client's virtual machine. This is accomplished through a flaw in filename validation during the extraction of gzip archives, permitting the use of absolute paths that can overwrite critical files, including the SQLite database. While exploitation requires an initial compromise of the SecureDrop Server, which operates under strict security measures and is only accessible via Tor hidden services, the potential impact on the confidentiality, integrity, and availability of sensitive submissions is significant. This issue is distinct from similar vulnerabilities and has been addressed in version 0.17.5.

References