CVE-2026-112303: GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gdresource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need an account or prior access to exploit this issue?
No attacker privileges are required. The attacker needs to provide a crafted project containing attacker-controlled resource URLs and convince a victim to open it in the desktop application.
What can an attacker obtain if exploitation succeeds?
The crafted resource download can send the victim's gd_resource cookie to an attacker-controlled server. This may expose private cloud project resources associated with that cookie.
Which installations should be treated as affected?
GDevelop Desktop App versions through 5.6.284 are identified as affected. The provided information does not specify a fixed version.