Password Pusher CVE-2026-41308

Exploitation requires two specific configuration settings to be enabled simultaneously: (1) allow_anonymous must be set to true in config/settings.yml (non-default, requires explicit admin configuration), AND (2) enable_file_pushes must be set to true (non-default, requires explicit admin configuration). The attack uses the generic JSON API create path (/p.json for v1 or /api/v2/pushes for v2) with a POST request containing a 'files' parameter or kind='file' parameter. Exploitation is prevented by default if either setting is false. No special user interaction, valid authentication tokens, or non-default deployment modes are required beyond these two configuration flags; once enabled, any remote unauthenticated client can exploit this via standard HTTP POST requests.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:N) indicates network-accessible unauthenticated exploitation with low attack complexity, assigning medium severity due to integrity and availability impact (I:L/A:L) rather than confidentiality. However, the practical risk depends critically on deployment configuration: the vulnerability only manifests when both allow_anonymous is explicitly enabled (non-default) AND enable_file_pushes is enabled. The source code evidence confirms that file uploads require an active file store backend, limiting real-world impact to instances that have intentionally enabled file attachment features. The CWE-288 classification is appropriate, representing authentication bypass rather than a cryptographic or access-control flaw. No EPSS score, KEV status, or POC availability data provided, but the detailed GitHub security advisory (GHSA-qfh8-f79c-x86c) with complete source code fix and comprehensive test cases (including three specific authentication-bypass scenarios in test suite) indicates this vulnerability was discovered and patched responsibly. Risk is elevated for multi-tenant or cloud-hosted deployments where users may not control configuration, but negligible for instances with default settings (allow_anonymous=false) or file uploads disabled.

An attacker discovers a publicly accessible Password Pusher instance and issues an unauthenticated POST request to /p.json or /api/v2/pushes with a JSON payload containing sensitive files and a 'files' parameter. If allow_anonymous is enabled and file pushes are enabled, the server accepts the request without credential validation, creates the push object, stores the uploaded files in the backend file store, and returns a URL token allowing the attacker to retrieve or distribute the files later. The attacker can repeat this to stage malware, exfiltrate corporate data, or create a denial-of-service condition by uploading large files.