CVE-2026-82521

MediumCVSS 5.3

Published: 03/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

35th percentile - higher than 35% of all known CVEs

Summary

parsedmarc versions 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

Risk Assessment

An attacker can write files outside the intended directory, potentially leading to overwriting important files or placing malicious content in unexpected locations, possibly enabling further attacks.

Recommendation

It is recommended to update parsedmarc to version 11.0.1 or later and review the configuration for sample file output.

Other vulnerabilities in parsedmarc

CVE-2026-82520High
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.

Original NVD description (English source)

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS