CVE-2026-41308

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4	Patch
https://github.com/pglombardo/PasswordPusher/pull/4381	Issue Tracking Patch
https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apnotic:password_pusher::::::::
	cpe:2.3:a:apnotic:password_pusher::::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Password Pusher es una aplicación de código abierto para comunicar información sensible a través de la web. Antes de las versiones 1.69.3 y 2.4.2, un problema de seguridad en OSS PasswordPusher permitía la creación no autenticada de envíos de tipo archivo a través de una ruta de creación genérica de la API JSON bajo ciertas configuraciones. Esto podría eludir el límite de autenticación previsto para la creación de envíos de archivos. Este problema ha sido parcheado en las versiones 1.69.3 y 2.4.2.

Information

Published : 2026-05-08 15:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-41308

Mitre link : CVE-2026-41308

CVE.ORG link : CVE-2026-41308

JSON object : View

Products Affected

apnotic

password_pusher

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

NVD-CWE-noinfo

{"id": "CVE-2026-41308", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41308", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:53:41.927769Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pglombardo", "product": "PasswordPusher", "versions": [{"status": "affected", "version": "< 1.69.3"}, {"status": "affected", "version": ">= 2.0.0-a, < 2.4.2"}]}]}], "published": "2026-05-08T15:16:39.480", "references": [{"url": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pglombardo/PasswordPusher/pull/4381", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-288"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2."}, {"lang": "es", "value": "Password Pusher es una aplicaci\u00f3n de c\u00f3digo abierto para comunicar informaci\u00f3n sensible a trav\u00e9s de la web. Antes de las versiones 1.69.3 y 2.4.2, un problema de seguridad en OSS PasswordPusher permit\u00eda la creaci\u00f3n no autenticada de env\u00edos de tipo archivo a trav\u00e9s de una ruta de creaci\u00f3n gen\u00e9rica de la API JSON bajo ciertas configuraciones. Esto podr\u00eda eludir el l\u00edmite de autenticaci\u00f3n previsto para la creaci\u00f3n de env\u00edos de archivos. Este problema ha sido parcheado en las versiones 1.69.3 y 2.4.2."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A40E5A4E-1B5D-436B-954C-79A0581B60AC", "versionEndExcluding": "1.69.3"}, {"criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B501892C-3C3A-45D0-814B-68F0E35097BF", "versionEndExcluding": "2.4.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}