The vulnerability CVE-2026-35465 affects freedomofpress securedrop-client versions prior to 0.17.5. It arises from insufficient validation of filenames in gzip archives extracted by the client, permitting absolute path traversal. This flaw enables a compromised SecureDrop Server to overwrite critical files on the client's virtual machine, including the SQLite database, potentially leading to code execution. Exploitation requires the attacker to have already compromised the SecureDrop Server, which is designed to be hardened and accessible only through Tor hidden services. The issue is similar to CVE-2025-24888 but occurs via a different code path. The vulnerability has been addressed in version 0.17.5 with a more robust fix implemented in the new SecureDrop Inbox codebase.

If exploited, this vulnerability allows an attacker who has compromised the SecureDrop Server to execute arbitrary code on the SecureDrop Client's virtual machine by overwriting critical files. This impacts the confidentiality, integrity, and availability of decrypted source submissions handled by the client. However, the attack complexity is high due to the prerequisite of server compromise and the server's hardened access controls via Tor.

This vulnerability has been fixed in securedrop-client version 0.17.5. Users should upgrade to version 0.17.5 or later to remediate this issue. Since this is not a cloud service, remediation depends on applying the client update. There is no indication of known exploits in the wild at this time.