Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-35465 is a high-severity Absolute Path Traversal (CWE-36) vulnerability in Freedom Securedrop-Client. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-35465 is a vulnerability in SecureDrop Client, a desktop application for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. It affects versions 0.17.4 and below, stemming from improper filename validation during gzip archive extraction on the client's virtual machine (sd-app). This flaw (CWE-36, CWE-73) allows absolute paths, enabling overwriting of critical files such as the SQLite database.
Exploitation requires prior compromise of the dedicated SecureDrop Server, which is hardened and accessible only via Tor hidden services. An attacker with network access, no privileges, but facing high attack complexity and requiring user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.5), can then achieve code execution on the client. This compromises confidentiality, integrity, and availability of decrypted source submissions.
The vulnerability is fixed in SecureDrop Client version 0.17.5, with a more robust implementation in the replacement SecureDrop Inbox codebase. The GitHub security advisory (GHSA-2jrc-x8fq-prvc), changelog, and patch commit (e518adaf897e7838467ccf9e1f28152ae6fe3655) detail the remediation, noting similarity to CVE-2025-24888 via a different code path.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23626
Vulnerability Data
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by…
more
exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops construction of absolute paths from untrusted data before they reach file operations.
Enforced access authorizations can limit which resources are reachable even if a traversal succeeds.
Least-privilege limits the set of files or directories any subject can affect, shrinking the blast radius of a path-control flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect absolute path traversal via static analysis and fuzzing.
Secure development lifecycle includes input validation and path-handling requirements that reduce absolute path traversal risk.
Application security requirements typically mandate controls against path traversal in file-access functions.
Secure architecture principles call for canonicalization and sandboxing that limit absolute path traversal.
Secure coding standards directly require neutralization of absolute path sequences in pathname construction.
Information access restriction limits which files can be reached but does not address the path-construction flaw itself.