CVE-2026-100389: GestSup before 3.2.61 Remote Code Execution via IMAP Attachment
GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GestSupto a version that resolves this vulnerability.Fixed in 3.2.61
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
GestSup deployments running a version before 3.2.61 are exposed if they use the basic IMAP connector to monitor a mailbox and store received attachments in the web-accessible upload/ticket directory.
What does an attacker need to exploit the vulnerability?
An attacker does not need authentication or user interaction. They need to be able to send an email containing a PHP attachment to a mailbox monitored by the vulnerable basic IMAP connector, then access the uploaded attachment through the web server.
Are all GestSup configurations affected by default?
The issue is specifically described in the basic IMAP connector's attachment handling. The provided information does not establish whether that connector is enabled by default.
What is the immediate mitigation if upgrading is not possible?
Prevent the monitored mailbox from accepting attacker-supplied PHP attachments and ensure files in the upload/ticket directory cannot be executed by the web server. Upgrading to 3.2.61 or later addresses the affected version range.