CVE-2026-41308

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4	Patch
https://github.com/pglombardo/PasswordPusher/pull/4381	Issue Tracking Patch
https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apnotic:password_pusher::::::::
	cpe:2.3:a:apnotic:password_pusher::::::::

History

No history.

Information

Published : 2026-05-08 15:16

Updated : 2026-06-17 10:46

NVD link : CVE-2026-41308

Mitre link : CVE-2026-41308

CVE.ORG link : CVE-2026-41308

JSON object : View

Products Affected

apnotic

password_pusher

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

NVD-CWE-noinfo

{"id": "CVE-2026-41308", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41308", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:53:41.927769Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pglombardo", "product": "PasswordPusher", "versions": [{"status": "affected", "version": "< 1.69.3"}, {"status": "affected", "version": ">= 2.0.0-a, < 2.4.2"}]}]}], "published": "2026-05-08T15:16:39.480", "references": [{"url": "https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pglombardo/PasswordPusher/pull/4381", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-288"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2."}], "lastModified": "2026-06-17T10:46:28.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A40E5A4E-1B5D-436B-954C-79A0581B60AC", "versionEndExcluding": "1.69.3"}, {"criteria": "cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B501892C-3C3A-45D0-814B-68F0E35097BF", "versionEndExcluding": "2.4.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}