CVE-2026-35465

OVERVIEW CVE-2026-35465 affects SecureDrop Client version 0.17.4 and below, a desktop application used by journalists to securely communicate with sources through the SecureDrop Workstation infrastructure. The vulnerability stems from improper filename validation during gzip archive extraction, allowing absolute paths that can overwrite critical system files, including the SQLite database containing decrypted source submissions. A compromised SecureDrop Server is required to exploit this flaw, representing a secondary compromise scenario rather than a direct client attack. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (High) despite elevated attack complexity, reflecting severe potential impact across confidentiality, integrity, and availability. The attack vector is network-based but requires user interaction and prior compromise of the hardened SecureDrop Server infrastructure, accessible only through Tor hidden services. Successful exploitation enables arbitrary code execution on the client virtual machine (sd-app) and potential destruction or manipulation of sensitive source materials, making this a critical concern within SecureDrop's threat model. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild. The EPSS score of 0.0005 indicates minimal real-world exploitation probability, and the vulnerability is not tracked in the Known Exploited Vulnerabilities catalog. Community attention has been limited given the narrow user base and high prerequisite attack complexity. The vulnerability has been remediated in version 0.17.5, with developers implementing a more robust fix than similar prior vulnerabilities, making timely patching the primary mitigation priority.