CVE-2026-41308: medium-severity vulnerability in pglombardo PasswordPusher
Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
pglombardo · PasswordPusherRelated CVEs — pglombardo PasswordPusher
In the same product, most dangerous first.
CVE-2026-62382MEDIUMPasswordPusher before v2.9.6 Authentication Bypass via Null ComparisonEPSS 1.2%CVE-2024-52796MEDIUMPassword Pusher's rate limiter can be bypassed by forging proxy headersEPSS 0.5%CVE-2026-61458HIGHPasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled EndpointEPSS 0.4%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2024-51989HIGHCross-site Scripting (XSS) Vulnerability in PasswordPusherEPSS 0.4%CVE-2024-56733MEDIUMPassword Pusher Allows Session Token Interception Leading to Potential HijackingEPSS 0.2%