CVE-2026-41308 Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
Unauthenticated attackers can create file pushes via JSON API, bypassing authentication controls in Password Pusher.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41308?
CVE-2026-41308 is a medium-severity authentication bypass vulnerability in pglombardo PasswordPusher, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
Weakness: CWE-288
Which versions are affected by CVE-2026-41308?
It affects 1 product.
Products include Apnotic Password Pusher.
How do I fix CVE-2026-41308?
No fix has been published for CVE-2026-41308 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-41308 being exploited?
There is no known exploitation of CVE-2026-41308 in the wild and no public exploit code.
Sources
Also known as GHSA-qfh8-f79c-x86c.