PasswordPusher

v2.8.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 26d Secrets & Credentials

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

communicate-passwords docker encryption file-sharing information-technology msp

+12 more

netsec netsec-tools password password-expiration password-pusher password-safety ruby secret security security-tools self-hosted upload-file

Affected surfaces

auth

Summary

AI summary

Restricts URL push payloads to http and https schemes, fixing GHSA-76c2-66pg-fj2f XSS vulnerability.

Full changelog

:memo: What’s Changed

This release fixes https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-76c2-66pg-fj2f where previously a malicious user could provide a specific payload to a URL push that can trigger an XSS vulnerability for recipients.

Thanks to @de3erve-hunter for reporting! A CVE has been requested. https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-76c2-66pg-fj2f will be updated once the CVE is available.

Restrict URL push payloads to http and https schemes to fix GHSA-76c2-66pg-fj2f (#4595) @pglombardo

:arrow_up: Dependencies updates

:arrow_up: Bump google-apis-core from 1.2.3 to 1.2.4 (#4593) @dependabot[bot]
:arrow_up: Bump thruster from 0.1.21 to 0.1.22 (#4594) @dependabot[bot]

:busts_in_silhouette: List of contributors

@dependabot[bot], @pglombardo and dependabot[bot]

:motor_boat: Docker Images

Available on Docker Hub:
https://hub.docker.com/r/pglombardo/pwpush

:running_man: Run This Version

Point DNS to your server (e.g. pwpush.example.com).
Download docker-compose.yml or clone the repo.
In docker-compose.yml, uncomment and set:
- TLS_DOMAIN: 'pwpush.example.com' for automatic Let’s Encrypt TLS.
Run:

docker compose up -d

Open https://pwpush.example.com or alternatively http://your-ip:5100.

:link: Useful Links

Security Fixes

GHSA-76c2-66pg-fj2f — restricts URL push payloads to http and https schemes, fixing XSS vulnerability

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track PasswordPusher

Get notified when new releases ship.

About PasswordPusher

Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.

All releases →