SecureDrop Client, used by journalists to download submissions from a SecureDrop Server, contains a flaw in the gzip extraction routine that accepts path names without proper validation. An attacker can supply a gzip archive containing an absolute path or specially crafted filename. When the client extracts the archive, the operating system resolves the path, allowing the attacker to overwrite critical files such as the client’s SQLite database. If the overwrite succeeds, arbitrary code can be executed within the virtual machine that hosts the SecureDrop Client. The vulnerability does not disclose data directly but its impact on confidentiality, integrity and availability of encrypted source submissions is high.

The issue affects the freedomofpress:securedrop-client product, specifically versions 0.17.4 and older. Any customer deploying versions prior to 0.17.5 is at risk. The vulnerability was fixed in SecureDrop Client 0.17.5.

The CVSS score of 7.5 classifies this flaw as High severity. While EPSS is not available, the entry is not listed in CISA KEV, indicating no known widespread exploitation yet. The attack requires prior compromise of the SecureDrop Server, which in turn is hardened and reachable only through Tor hidden services, adding difficulty. Nonetheless, the potential for local code execution on the client’s virtual machine, combined with the high impact on classified submissions, makes the risk significant if the server is breached.