Skip to content
Heist/ feed
Back to feed
Medium

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

Type: advisorySources: OSV

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-112303
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 18:46 UTC · Revision 1

Source evidence

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

core-osv · Original source

Published 19 Oct 2026, 15:28 UTC

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

osv:CVE-2026-112303
Complete source record
{
  "id": "3d5076f4da58f0e27447a6e36ef7100088a1c6ece6aa37f532e0b66743b512ae",
  "url": "https://osv.dev/vulnerability/CVE-2026-112303",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs",
    "summary": "GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.",
    "evidence": "osv:CVE-2026-112303",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-112303",
      "aliases": [
        "CVE-2026-112303"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/4ian/gdevelop",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "fbb01f40a640c35c6064f827065eda00e5608690"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "5.6.284"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "fbb01f40a640c35c6064f827065eda00e5608690"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v5.6.284",
            "v5.6.283",
            "v5.6.282",
            "v5.6.281",
            "v5.6.280",
            "v5.6.279",
            "v5.6.278",
            "v5.6.277",
            "v5.6.276",
            "v5.6.275",
            "v5.6.274",
            "v5.6.273",
            "v5.6.272",
            "v5.6.271",
            "v5.6.270",
            "v5.6.269",
            "v5.6.268",
            "v5.6.267",
            "v5.6.266",
            "v5.6.265",
            "v5.6.264",
            "v5.6.263",
            "v5.6.262",
            "v5.6.260",
            "v5.6.261",
            "v5.6.259",
            "v5.6.258",
            "v5.6.257",
            "v5.6.256",
            "v5.6.255",
            "v5.6.254",
            "v5.6.253",
            "v5.6.252",
            "v5.6.251",
            "v5.6.250",
            "v5.6.249",
            "v5.5.248",
            "v5.5.247",
            "v5.5.246",
            "v5.5.245",
            "v5.5.244",
            "v5.5.243",
            "v5.5.242",
            "v5.5.241",
            "v5.5.240",
            "v5.5.239",
            "v5.5.238",
            "v5.5.237",
            "v5.5.236",
            "v5.5.235",
            "v5.5.234",
            "v5.5.233",
            "v5.5.232",
            "v5.5.231",
            "v5.5.230",
            "v5.5.229",
            "v5.5.228",
            "v5.5.227",
            "v5.5.226",
            "v5.5.225",
            "v5.5.224",
            "v5.5.223",
            "v5.5.222",
            "v5.5.221",
            "v5.5.220",
            "v5.4.220",
            "v5.4.219",
            "v5.4.218",
            "v5.4.217",
            "v5.4.216",
            "v5.4.215",
            "v5.4.213",
            "v5.4.212",
            "v5.4.211",
            "v5.4.210",
            "v5.4.209",
            "v5.4.208",
            "v5.4.207",
            "v5.4.206",
            "v5.4.205",
            "v5.4.204",
            "v5.4.203",
            "v5.4.202-beta",
            "v5.3.201",
            "v5.3.200",
            "v5.3.199",
            "v5.3.198",
            "v5.3.197",
            "v5.3.196",
            "v5.3.195",
            "v5.3.194",
            "v5.3.193",
            "v5.3.192",
            "v5.3.191",
            "v5.3.190",
            "v5.3.189",
            "v5.3.188",
            "v5.3.187",
            "v5.3.186",
            "v5.3.185",
            "v5.3.184",
            "v5.3.183",
            "v5.3.182",
            "v5.3.181",
            "v5.3.180",
            "v5.3.179",
            "v5.2.178",
            "v5.2.177",
            "v5.2.176",
            "v5.2.175",
            "v5.2.174",
            "v5.2.173",
            "v5.2.172",
            "v5.2.171",
            "v5.2.170",
            "v5.2.169",
            "v5.2.168",
            "v5.2.167",
            "v5.2.166",
            "v5.2.165",
            "v5.1.164",
            "v5.1.163",
            "v5.1.162",
            "v5.1.161",
            "v5.1.160",
            "v5.1.159",
            "v5.1.158",
            "v5.1.157",
            "v5.1.156",
            "v5.1.155",
            "v5.1.154",
            "v5.1.153",
            "v5.1.152",
            "v5.1.151",
            "v5.1.150",
            "v5.1.149",
            "v5.1.148",
            "v5.1.147",
            "v5.0.146",
            "v5.0.145",
            "v5.0.144",
            "v5.0.143",
            "v5.0.142",
            "v5.0.141",
            "v5.0.140",
            "v5.0.139",
            "v5.0.138",
            "v5.0.137",
            "v5.0.136",
            "v5.0.135",
            "v5.0.134",
            "v5.0.133",
            "v5.0.132",
            "v5.0.132-beta1",
            "v5.0.131",
            "v5.0.130",
            "v5.0.129",
            "v5.0.128",
            "v5.0.127",
            "v5.0.126",
            "v5.0.125",
            "v5.0.124",
            "v5.0.123",
            "v5.0.122",
            "v5.0.122-beta1",
            "v5.0.121",
            "v5.0.120",
            "v5.0.0-beta119",
            "v5.0.0-beta118",
            "v5.0.0-beta117",
            "v5.0.0-beta116",
            "v5.0.0-beta115",
            "v5.0.0-beta114",
            "v5.0.0-beta113",
            "v5.0.0-beta112",
            "v5.0.0-beta111",
            "v5.0.0-beta110",
            "v5.0.0-beta109",
            "v5.0.0-beta108",
            "v5.0.0-beta107",
            "v5.0.0-beta106",
            "v5.0.0-beta105",
            "v5.0.0-beta104",
            "v5.0.0-beta103",
            "v5.0.0-beta102",
            "v5.0.0-beta101",
            "v5.0.0-beta100",
            "v5.0.0-beta99",
            "v5.0.0-beta98",
            "v5.0.0-beta97",
            "v5.0.0-beta96",
            "v5.0.0-beta95",
            "v5.0.0-beta94",
            "v5.0.0-beta93",
            "v5.0.0-beta92",
            "v5.0.0-beta91",
            "v5.0.0-beta90",
            "v5.0.0-beta89",
            "v5.0.0-beta88",
            "v5.0.0-beta87",
            "v5.0.0-beta86",
            "v5.0.0-beta85",
            "v5.0.0-beta84",
            "v5.0.0-beta83",
            "v5.0.0-beta82",
            "v5.0.0-beta81",
            "v5.0.0-beta80",
            "v5.0.0-beta79",
            "v5.0.0-beta78",
            "v5.0.0-beta77",
            "v5.0.0-beta76",
            "v5.0.0-beta75",
            "v5.0.0-beta74",
            "v5.0.0-beta73",
            "v5.0.0-beta72",
            "v5.0.0-beta70",
            "v5.0.0-beta69",
            "v5.0.0-beta68",
            "v5.0.0-beta67",
            "v5.0.0-beta66",
            "v5.0.0-beta65",
            "v5.0.0-beta64",
            "v5.0.0-beta63",
            "v5.0.0-beta62",
            "v5.0.0-beta61",
            "v5.0.0-beta59",
            "v5.0.0-beta58",
            "v5.0.0-beta57",
            "v5.0.0-beta56",
            "v5.0.0-beta55",
            "v5.0.0-beta54",
            "v5.0.0-beta52",
            "v5.0.0-beta51",
            "v5.0.0-beta50",
            "v5.0.0-beta49",
            "v5.0.0-beta48",
            "v5.0.0-beta47",
            "v5.0.0-beta45",
            "v5.0.0-beta42",
            "v5.0.0-beta40",
            "v5.0.0-beta39",
            "v5.0.0-beta37",
            "v5.0.0-beta36",
            "v5.0.0-beta34",
            "v5.0.0-beta33",
            "v5.0.0-beta31",
            "v5.0.0-beta30",
            "v5.0.0-beta29",
            "4.0.97",
            "4.0.96",
            "4.0.95",
            "new-ide-beta1",
            "4.0.93",
            "4.0.92",
            "4.0.91",
            "4.0.90",
            "4.0.89",
            "4.0.88",
            "4.0.87",
            "4.0.86",
            "4.0.85",
            "3.6.78",
            "3.6.77",
            "3.6.76",
            "3.5.75",
            "3.5.74",
            "3.4.73",
            "3.4.72.2",
            "3.4.72"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112303.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.334673596Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112303.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-112303",
        "https://www.vulncheck.com/advisories/gdevelop-through-5.6.284-cookie-leak-via-localfiledownloader-resource-urls",
        "https://github.com/4ian/GDevelop/issues/9257",
        "https://github.com/4ian/GDevelop/commit/fbb01f40a640c35c6064f827065eda00e5608690",
        "https://github.com/4ian/GDevelop",
        "https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/app/src/ProjectsStorage/LocalFileStorageProvider/LocalFileResourceMover.js",
        "https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/electron-app/app/LocalFileDownloader.js"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-522"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112303.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-112303",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505841,
  "published_at": "2026-10-19T15:28:54.002+00:00"
}