CVE-2026-82521 Details

A path traversal vulnerability has been identified in Parsedmarc versions 9.0.6 prior to 11.0.1. The issue arises in the forensic report sample output, where the filename is generated based on the email subject. If the subject contains only path traversal sequences, the filename sanitization process results in an empty string. This empty string triggers a fallback to the raw, unsanitized subject, leading to the file being written outside the designated samples directory. An attacker capable of sending a crafted subject that causes a forensic failure report can exploit this vulnerability to write a dot-prefixed file with controlled content to an ancestor directory of the configured samples output path. The exploitation requires that the forensic report sample output feature is enabled.

Users can upgrade to Parsedmarc version 11.0.1, where this vulnerability has been patched. In the updated version, the filename sanitization process has been improved to prevent path traversal exploitation.