CVE-2026-41308CWE-288

Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication

Medium · published May 8, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-05-08T14:30Z
EPSS history
Timeline
  • 08 MAY 14:30Z
    Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
    cvelistv5