Read the docs
TI-2026-29909 Aliases CVE-2026-41308

Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication

Priority LOW 35CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00289 21st percentileScored 2026-11-07
Fix Fixed PasswordPusher (pglombardo): 1.69.3, 2.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pglombardoPasswordPusherbefore 1.69.3; 2.0.0-a to before 2.4.21.69.3, 2.4.2Patch availableCNA
  • PasswordPusher Vendorpglombardo Affected before 1.69.3; 2.0.0-a to before 2.4.2 Fixed in 1.69.3, 2.4.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*before 1.69.3; 2.0.0 to before 2.4.2VulnerableApnotic
  • cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:* Versions before 1.69.3; 2.0.0 to before 2.4.2 Vulnerable ·Apnotic

Remediation

  • Fix · CNA PasswordPusher (pglombardo) Fixed in 1.69.3, 2.4.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41308

References

Patch 2

Advisory 1

  • TI-2026-59933 PasswordPusher before 2.11.1 Race Condition View Limit Bypass CVSS 4.0HIGH 8.7
  • TI-2026-44063 PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint CVSS 4.0HIGH 8.7
  • TI-2026-44522 PasswordPusher before v2.9.6 Authentication Bypass via Null Comparison CVSS 4.0MEDIUM 6.9
  • TI-2024-35309 Password Pusher's rate limiter can be bypassed by forging proxy headers CVSS 3.1MEDIUM 5.3
  • TI-2024-34877 Cross-site Scripting (XSS) Vulnerability in PasswordPusher CVSS 3.1HIGH 7.1
  • TI-2024-37617 Password Pusher Allows Session Token Interception Leading to Potential Hijacking CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences