CVE-2026-82521
MEDIUM
MEDIUM
Priority: 0.03
BB Relevance:
73/100
Published: 2026-09-03
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
Present
VC:
None
VI:
Low
VA:
None
Description
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| domainaware | parsedmarc | 9.0.6 < 11.0.1 |
References & Advisories (3)
vendor-advisory
third-party-advisory
release-notes
patch