Vulnerability Description
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-n
- https://gestsup.fr/index.php?page=changelog
- https://gestsup.fr/index.php?page=download
- https://www.vulncheck.com/advisories/gestsup-before-3.2.61-remote-code-execution
FAQ
What is CVE-2026-100389?
CVE-2026-100389 is a vulnerability with a CVSS score of 8.1 (HIGH). GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can...
How severe is CVE-2026-100389?
CVE-2026-100389 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100389?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.