CyberRota Analysis
AI-GeneratedParsedmarc versions prior to 11.0.1 are vulnerable due to improper handling of email subject lines, which can lead to path traversal vulnerabilities. An attacker can exploit this by crafting a malicious email subject that causes the application to write files outside the intended directory, potentially allowing the execution of arbitrary code. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized file access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.