CVE-2026-112303
CVE-2026-112303 · GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.
CVSS 5.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
gdevelop
- Versiones
- ≥ 0, ≤ 5.6.284: Afectada (custom)
Sin corrección publicada
Fuentes originales
- https://github.com/4ian/GDevelop/issues/9257
- https://github.com/4ian/GDevelop/commit/fbb01f40a640c35c6064f827065eda00e5608690
- https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/electron-app/app/LocalFileDownloader.js
- https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/app/src/ProjectsStorage/LocalFileStorageProvider/LocalFileResourceMover.js
- https://www.vulncheck.com/advisories/gdevelop-through-5.6.284-cookie-leak-via-localfiledownloader-resource-urls
- https://nvd.nist.gov/vuln/detail/CVE-2026-112303