GDevelop CVE-2026-112303

Requires the victim to be running the GDevelop desktop (Electron) app through version 5.6.284 while holding an active GDevelop cloud session (the gd_resource/cloud session cookie must exist locally), AND to open a crafted project file in which a resource's 'file' path points to an attacker-controlled URL; the unpatched downloadLocalFile() then attaches the cloud cookie to that outbound request regardless of host. Limiting factors that reduce real-world risk: mandatory user interaction (victim must obtain and open the malicious project), the leak only yields value if the victim is authenticated to GDevelop cloud, the attack is single-victim (not automatable/wormable), and only confidentiality of the session cookie / private cloud resources is affected - no integrity or availability impact.

This is a medium-severity (CVSS 4.0 base 5.3) information-disclosure flaw, and the real-world signals point to limited, opportunistic risk rather than mass exploitation. The vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L) shows network-reachable, low-complexity, no-privilege exploitation with only LOW confidentiality impact and crucially requires passive user interaction (UI:P) - the victim must open a malicious project - which rules out automatable, wormable exploitation. No EPSS score, KEV listing, or POC was provided in the input: exploitation status is best described as no public exploit identified at time of analysis, and the flaw is NOT in CISA KEV. The GitHub commit (fbb01f4) confirms the technical root cause (cookie attached to arbitrary resource hosts), so the vulnerability itself is well-substantiated even though no in-the-wild activity is evidenced. Net: a credible, vendor-patched credential-leak bug worth patching for GDevelop cloud users, but not an emergency given the required user interaction, single-victim scope, and absence of exploitation signals. One caveat to verify: the CVSS carries PR:N (unauthenticated to trigger), yet the leak only has value if the victim holds an active GDevelop cloud session cookie - so the practical impact is conditioned on victim authentication state even though triggering requires no attacker privileges.

An attacker crafts a GDevelop project file whose resource 'file' path points to an attacker-controlled URL and social-engineers a logged-in GDevelop user into opening it. When the desktop app resolves local resources, downloadLocalFile() attaches the victim's GDevelop cloud session (gd_resource) cookie to the outbound request, leaking it to the attacker's server and granting access to the victim's private cloud project resources. No public exploit is identified, but the patch diff confirms the exact exfiltration mechanism.