The vulnerability CVE-2026-35465 affects the SecureDrop Client desktop application used by journalists to securely communicate with sources. In versions 0.17.4 and earlier, the client improperly validates filenames when extracting gzip archives, permitting absolute path traversal. This flaw allows a compromised SecureDrop Server to overwrite critical client files, such as the SQLite database, potentially leading to code execution within the client's virtual machine (sd-app). Exploitation requires the attacker to have already compromised the SecureDrop Server, which is designed to be hardened and accessible only via Tor hidden services. The vulnerability is similar to CVE-2025-24888 but occurs through a different code path. The issue was addressed in version 0.17.5 with a more robust fix implemented in the new SecureDrop Inbox codebase.

Successful exploitation can result in code execution on the SecureDrop Client's virtual machine, allowing an attacker to compromise the confidentiality, integrity, and availability of decrypted source submissions. Given the requirement of prior server compromise and the hardened nature of the SecureDrop Server, the attack complexity is high. However, the impact on the client environment is significant if exploited.

This vulnerability has been fixed in SecureDrop Client version 0.17.5. Users should upgrade to version 0.17.5 or later to remediate this issue. Since this is a client-side application and not a cloud service, applying the official fix is necessary to mitigate the risk. No additional mitigation steps are indicated beyond upgrading to the patched version.