Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/pglombardo/PasswordPusher/commit/45dc2512875231ef45ecd5dfc8c3c8185f882bf4 Patch
- https://github.com/pglombardo/PasswordPusher/pull/4381 Issue Tracking, Patch
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-qfh8-f79c-x86c Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · apnoticNVD modified 2026-10-26 18:10
Affected (CPE criteria) 1
cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:*