Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-82521parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject
Medium 5.3
In plain English
A medium-severity path traversal in parsedmarc from domainaware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| domainaware | parsedmarc | 9.0.6 – before 11.0.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-c284-w5m6-jhjm) vendor-advisory
- Release Notes release-notes, patch
- https://www.vulncheck.com/advisories/parsedmarc-path-traversal-via-forensic-report-subject third-party-advisory