CVE-2026-41308: Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41308?
CVE-2026-41308 is considered a high severity vulnerability due to its potential for unauthenticated access and file manipulation.
How do I fix CVE-2026-41308?
To fix CVE-2026-41308, upgrade to Password Pusher versions 1.69.3 or 2.4.2 or later that address this vulnerability.
What are the consequences of CVE-2026-41308?
The consequences of CVE-2026-41308 include unauthorized file uploads and potential exposure of sensitive information.
Which versions of Password Pusher are affected by CVE-2026-41308?
CVE-2026-41308 affects Password Pusher versions prior to 1.69.3 and 2.4.2.
What types of attacks can be executed exploiting CVE-2026-41308?
Exploiting CVE-2026-41308 can allow attackers to perform unauthorized file uploads, potentially compromising the system.