CVE-2026-112303

MEDIUM 4.3

GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources.

CWE	CWE-522
Vendor	gdevelop
Product	gdevelop
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for gdevelop gdevelop

Be the first to know when new medium vulnerabilities affecting gdevelop gdevelop are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

GDevelop / GDevelop

0 ≤ 5.6.284

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/4ian/GDevelop/issues/9257 github.com: https://github.com/4ian/GDevelop/commit/fbb01f40a640c35c6064f827065eda00e5608690 github.com: https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/electron-app/app/LocalFileDownloader.js github.com: https://github.com/4ian/GDevelop/blob/v5.6.284/newIDE/app/src/ProjectsStorage/LocalFileStorageProvider/LocalFileResourceMover.js vulncheck.com: https://www.vulncheck.com/advisories/gdevelop-through-5.6.284-cookie-leak-via-localfiledownloader-resource-urls

Credits

George Chen