Description

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T21:17:22.553Z",
  "pubdate": "2026-09-03T21:17:22.553Z",
  "executiveSummary": "A path traversal vulnerability exists in parsedmarc versions 9.0.6 through 11.0.0, stemming from improper filename sanitization when processing forensic report samples. The vulnerability allows an attacker to bypass directory constraints by crafting an email subject composed entirely of path traversal sequences.\nIf the forensic report samples output feature is enabled, an attacker can manipulate the output path to write files outside the designated samples directory. This leads to arbitrary file write capabilities, allowing the creation of dot-prefixed files in ancestor directories with attacker-controlled content. The impact includes potential system compromise, configuration tampering, or data exfiltration, depending on the file location and the permissions of the user running the parsedmarc service. Exploitation requires the attacker to successfully trigger a forensic failure report that includes the malicious subject line.",
  "technicalDetails": "The vulnerability resides in the filename sanitization logic employed by parsedmarc when generating forensic report sample files. The system derives the output filename directly from the 'Subject' header of an incoming email. When a subject line consists exclusively of path traversal sequences (e.g., '../../'), the internal sanitization function fails to produce a valid, safe string and instead returns an empty string.\nUpon encountering an empty string result from the sanitization function, the application logic falls back to using the raw, unsanitized subject as the filename. This bypasses the intended directory protections, allowing the application to resolve a path outside the configured samples output directory. By using a series of traversal characters, an attacker can navigate to ancestor directories relative to the target output directory.\nThe attack flow begins when an attacker sends an email crafted to trigger a forensic failure report. The email contains a malicious 'Subject' header designed to exploit the sanitization flaw. When parsedmarc processes this report, it attempts to write the forensic sample to disk. Because the sanitization function collapses the malicious subject into an empty string and defaults to the unsafe input, the file system path is constructed using the directory traversal sequences provided by the attacker.\nThis allows the attacker to write files into restricted locations, albeit with the limitation that the resulting files are dot-prefixed. This is highly effective for overwriting or creating hidden configuration files, SSH authorized keys, or other critical files in the parent directory structure of the application's runtime environment. The impact is essentially arbitrary file creation with content determined by the forensic report data. The vulnerability is present in all versions prior to 11.0.1. No specific authentication is required if the attacker can influence the input processed by the system. The exposure is limited to environments where the 'save_forensic_samples' configuration is explicitly enabled, as the flaw is tied directly to the file output subsystem."
}