Vulnerability Description
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/domainaware/parsedmarc/releases/tag/11.0.1
- https://github.com/domainaware/parsedmarc/security/advisories/GHSA-c284-w5m6-jhj
- https://www.vulncheck.com/advisories/parsedmarc-path-traversal-via-forensic-repo
FAQ
What is CVE-2026-82521?
CVE-2026-82521 is a vulnerability with a CVSS score of 5.3 (MEDIUM). parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename san...
How severe is CVE-2026-82521?
CVE-2026-82521 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82521?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.