Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck
CVE-2026-100389GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
High 8.1
In plain English
A high-severity unrestricted file upload in GestSup from GestSup. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 52.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gestsup.fr/index.php?page=changelog release-notes
- https://gestsup.fr/index.php?page=download product
- VulnCheck Advisory: GestSup before 3.2.61 Remote Code Execution via IMAP Attachment third-party-advisory
- https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/ technical-description, exploit