{"id":"CVE-2026-112303","summary":"GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs","details":"GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.","modified":"2026-10-21T02:56:02.243919838Z","published":"2026-10-19T15:28:54.002Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112303.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-522"]},"references":[{"type":"PACKAGE","url":"https://github.com/4ian/GDevelop"},{"type":"ARTICLE","url":"https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/app/src/ProjectsStorage/LocalFileStorageProvider/LocalFileResourceMover.js"},{"type":"ARTICLE","url":"https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/electron-app/app/LocalFileDownloader.js"},{"type":"FIX","url":"https://github.com/4ian/GDevelop/commit/fbb01f40a640c35c6064f827065eda00e5608690"},{"type":"REPORT","url":"https://github.com/4ian/GDevelop/issues/9257"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112303.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112303"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gdevelop-through-5.6.284-cookie-leak-via-localfiledownloader-resource-urls"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/4ian/gdevelop","events":[{"introduced":"0"},{"last_affected":"3fb59a81a4e6320bc50828e23a16dcd3d8485f59"},{"fixed":"fbb01f40a640c35c6064f827065eda00e5608690"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"5.6.284"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"fbb01f40a640c35c6064f827065eda00e5608690"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v5.6.284","v5.6.283","v5.6.282","v5.6.281","v5.6.280","v5.6.279","v5.6.278","v5.6.277","v5.6.276","v5.6.275","v5.6.274","v5.6.273","v5.6.272","v5.6.271","v5.6.270","v5.6.269","v5.6.268","v5.6.267","v5.6.266","v5.6.265","v5.6.264","v5.6.263","v5.6.262","v5.6.260","v5.6.261","v5.6.259","v5.6.258","v5.6.257","v5.6.256","v5.6.255","v5.6.254","v5.6.253","v5.6.252","v5.6.251","v5.6.250","v5.6.249","v5.5.248","v5.5.247","v5.5.246","v5.5.245","v5.5.244","v5.5.243","v5.5.242","v5.5.241","v5.5.240","v5.5.239","v5.5.238","v5.5.237","v5.5.236","v5.5.235","v5.5.234","v5.5.233","v5.5.232","v5.5.231","v5.5.230","v5.5.229","v5.5.228","v5.5.227","v5.5.226","v5.5.225","v5.5.224","v5.5.223","v5.5.222","v5.5.221","v5.5.220","v5.4.220","v5.4.219","v5.4.218","v5.4.217","v5.4.216","v5.4.215","v5.4.213","v5.4.212","v5.4.211","v5.4.210","v5.4.209","v5.4.208","v5.4.207","v5.4.206","v5.4.205","v5.4.204","v5.4.203","v5.4.202-beta","v5.3.201","v5.3.200","v5.3.199","v5.3.198","v5.3.197","v5.3.196","v5.3.195","v5.3.194","v5.3.193","v5.3.192","v5.3.191","v5.3.190","v5.3.189","v5.3.188","v5.3.187","v5.3.186","v5.3.185","v5.3.184","v5.3.183","v5.3.182","v5.3.181","v5.3.180","v5.3.179","v5.2.178","v5.2.177","v5.2.176","v5.2.175","v5.2.174","v5.2.173","v5.2.172","v5.2.171","v5.2.170","v5.2.169","v5.2.168","v5.2.167","v5.2.166","v5.2.165","v5.1.164","v5.1.163","v5.1.162","v5.1.161","v5.1.160","v5.1.159","v5.1.158","v5.1.157","v5.1.156","v5.1.155","v5.1.154","v5.1.153","v5.1.152","v5.1.151","v5.1.150","v5.1.149","v5.1.148","v5.1.147","v5.0.146","v5.0.145","v5.0.144","v5.0.143","v5.0.142","v5.0.141","v5.0.140","v5.0.139","v5.0.138","v5.0.137","v5.0.136","v5.0.135","v5.0.134","v5.0.133","v5.0.132","v5.0.132-beta1","v5.0.131","v5.0.130","v5.0.129","v5.0.128","v5.0.127","v5.0.126","v5.0.125","v5.0.124","v5.0.123","v5.0.122","v5.0.122-beta1","v5.0.121","v5.0.120","v5.0.0-beta119","v5.0.0-beta118","v5.0.0-beta117","v5.0.0-beta116","v5.0.0-beta115","v5.0.0-beta114","v5.0.0-beta113","v5.0.0-beta112","v5.0.0-beta111","v5.0.0-beta110","v5.0.0-beta109","v5.0.0-beta108","v5.0.0-beta107","v5.0.0-beta106","v5.0.0-beta105","v5.0.0-beta104","v5.0.0-beta103","v5.0.0-beta102","v5.0.0-beta101","v5.0.0-beta100","v5.0.0-beta99","v5.0.0-beta98","v5.0.0-beta97","v5.0.0-beta96","v5.0.0-beta95","v5.0.0-beta94","v5.0.0-beta93","v5.0.0-beta92","v5.0.0-beta91","v5.0.0-beta90","v5.0.0-beta89","v5.0.0-beta88","v5.0.0-beta87","v5.0.0-beta86","v5.0.0-beta85","v5.0.0-beta84","v5.0.0-beta83","v5.0.0-beta82","v5.0.0-beta81","v5.0.0-beta80","v5.0.0-beta79","v5.0.0-beta78","v5.0.0-beta77","v5.0.0-beta76","v5.0.0-beta75","v5.0.0-beta74","v5.0.0-beta73","v5.0.0-beta72","v5.0.0-beta70","v5.0.0-beta69","v5.0.0-beta68","v5.0.0-beta67","v5.0.0-beta66","v5.0.0-beta65","v5.0.0-beta64","v5.0.0-beta63","v5.0.0-beta62","v5.0.0-beta61","v5.0.0-beta59","v5.0.0-beta58","v5.0.0-beta57","v5.0.0-beta56","v5.0.0-beta55","v5.0.0-beta54","v5.0.0-beta52","v5.0.0-beta51","v5.0.0-beta50","v5.0.0-beta49","v5.0.0-beta48","v5.0.0-beta47","v5.0.0-beta45","v5.0.0-beta42","v5.0.0-beta40","v5.0.0-beta39","v5.0.0-beta37","v5.0.0-beta36","v5.0.0-beta34","v5.0.0-beta33","v5.0.0-beta31","v5.0.0-beta30","v5.0.0-beta29","4.0.97","4.0.96","4.0.95","new-ide-beta1","4.0.93","4.0.92","4.0.91","4.0.90","4.0.89","4.0.88","4.0.87","4.0.86","4.0.85","3.6.78","3.6.77","3.6.76","3.5.75","3.5.74","3.4.73","3.4.72.2","3.4.72"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112303.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}