Skip to content
Heist/ feed
Back to feed
Medium

parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject

Type: advisorySources: OSV

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-82521
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 07:35 UTC · Revision 1

Source evidence

parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject

core-osv · Original source

Published 3 Sept 2026, 20:41 UTC

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

osv:CVE-2026-82521
Complete source record
{
  "id": "90ba2ff967a483a54a66a3643e09471f01ec91d2846d7f8d45bc93f0cb042773",
  "url": "https://osv.dev/vulnerability/CVE-2026-82521",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject",
    "summary": "parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.",
    "evidence": "osv:CVE-2026-82521",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-82521",
      "aliases": [
        "CVE-2026-82521",
        "GHSA-c284-w5m6-jhjm"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/domainaware/parsedmarc",
              "type": "GIT",
              "events": [
                {
                  "introduced": "35331d4b84a36ee499f0fefc541594b7be3ca238"
                },
                {
                  "fixed": "09c88ca2a36af198ebcc85413ce2fa92ff555093"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "9.0.6"
                      },
                      {
                        "fixed": "11.0.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "09c88ca2a36af198ebcc85413ce2fa92ff555093"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "11.0.1"
                  },
                  {
                    "range": [
                      {
                        "introduced": "9.0.6"
                      },
                      {
                        "fixed": "11.0.1"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "11.0.0",
            "10.5.0",
            "10.4.3",
            "10.4.2",
            "10.4.1",
            "10.4.0",
            "10.3.0",
            "10.2.4",
            "10.2.2",
            "10.2.1",
            "10.2.0",
            "10.1.1",
            "10.1.0",
            "10.0.4",
            "10.0.3",
            "10.0.0",
            "9.11.2",
            "9.11.1",
            "9.11.0",
            "9.10.3",
            "9.10.2",
            "9.10.1",
            "9.10.0",
            "9.9.0",
            "9.8.0",
            "9.7.1",
            "9.7.0",
            "9.6.0",
            "9.5.5",
            "9.5.4",
            "9.5.3",
            "9.5.2",
            "9.5.1",
            "9.5.0",
            "9.4.0",
            "9.3.1",
            "9.3.0",
            "9.2.1",
            "9.2.0",
            "9.1.2",
            "9.1.1",
            "9.0.10",
            "9.0.7",
            "9.0.6"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82521.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.703727870Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82521.json",
        "https://github.com/domainaware/parsedmarc/security/advisories/GHSA-c284-w5m6-jhjm",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-82521",
        "https://www.vulncheck.com/advisories/parsedmarc-path-traversal-via-forensic-report-subject",
        "https://github.com/domainaware/parsedmarc/releases/tag/11.0.1",
        "https://github.com/domainaware/parsedmarc"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82521.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82521",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493416,
  "published_at": "2026-09-03T20:41:16.071+00:00"
}