Description
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
Affected products
apnotic: password pusher
References3
- github.com/pglombardo/PasswordPusher/security/advisories/GHSA-q… Vendor Advisory
- github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45e… Patch
- github.com/pglombardo/PasswordPusher/pull/4381 Issue TrackingPatch
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - EPSS — exploit probability
- 0% percentile: 22 · as of 13 November 2026
- CWE
- CWE-288
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.