Report: CVE-2026-41308 - Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authent

Report: CVE-2026-41308 - Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authent

CVE ID :CVE-2026-41308 Published : May 8, 2026, 2:30 p.m. | 57 minutes ago Description :Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

Published
May 8, 2026