CVE-2026-82521: parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
parsedmarcto a version that resolves this vulnerability.Fixed in 11.0.1 - Configuration
Disable file output for forensic report samples so that crafted Subject data cannot be written to the configured samples output path.
parsedmarc forensic report sample file output (enabled/disabled) = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running parsedmarc 9.0.6 through versions before 11.0.1 are affected only when file output for forensic report samples is enabled. The issue applies to processing forensic failure reports.
What does an attacker need to do to exploit it?
An attacker must be able to cause a forensic failure report with a crafted Subject consisting entirely of path traversal sequences to be processed. No authentication or user interaction is indicated by the provided severity vector.
What can an attacker write, and where?
Successful exploitation can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. The write occurs because an empty sanitized filename falls back to the raw Subject value.
What mitigation is available if upgrading cannot happen immediately?
Disable file output for forensic report samples. Exploitation requires this output feature to be enabled.