A vulnerability in the SecureDrop Client allows an attacker who has compromised the associated SecureDrop Server to achieve remote code execution on the Client virtual machine.

This flaw involves improper validation of filenames during the extraction of gzip archives, which allows for absolute path traversal. An unauthenticated attacker who successfully compromises the upstream SecureDrop Server can leverage this to overwrite critical system files, including the SQLite database, to execute arbitrary code on the client machine.

The potential for remote code execution represents a critical risk to the confidentiality and integrity of highly sensitive journalistic communications. Given the CVSS score of 7.5, this vulnerability could allow an adversary to decrypt or intercept source submissions, leading to severe reputational damage and the potential exposure of protected sources. The impact is elevated because the SecureDrop system is specifically designed to handle high-stakes, anonymous whistleblowing data.

Immediate Action: Update the SecureDrop Client software to version 0.17.5 or later immediately to incorporate the necessary filename validation logic.

Proactive Monitoring: Monitor virtual machine logs and system integrity metrics for unauthorized file modifications or unexpected process execution within the sd-app environment.

Compensating Controls: Ensure that the SecureDrop Server remains strictly isolated and hardened, as the exploit chain relies on the prior compromise of the server component.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing SecureDrop must prioritize the upgrade to version 0.17.5 to remediate the path traversal flaw. Because this vulnerability provides a mechanism for persistence and data exfiltration after a server compromise, failure to patch leaves the entire submission workflow exposed to advanced adversaries. Apply the update as part of the next scheduled maintenance window or sooner if the environment is considered high-risk.