CVE-2026-82521

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82521
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82521.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82521
Aliases
  • GHSA-c284-w5m6-jhjm
Published
2026-09-03T20:41:16Z
Modified
2026-09-05T03:48:20Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject
Details

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82521.json"
}
References

Affected packages

Git / github.com/domainaware/parsedmarc

Affected ranges

Type
GIT
Repo
https://github.com/domainaware/parsedmarc
Events
Introduced
35331d4b84a36ee499f0fefc541594b7be3ca238
Fixed
09c88ca2a36af198ebcc85413ce2fa92ff555093
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "9.0.6"
        },
        {
            "fixed": "11.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

10.*
10.0.0
10.0.3
10.0.4
10.1.0
10.1.1
10.2.0
10.2.1
10.2.2
10.2.4
10.3.0
10.4.0
10.4.1
10.4.2
10.4.3
10.5.0
11.*
11.0.0
9.*
9.0.10
9.0.6
9.0.7
9.1.1
9.1.2
9.10.0
9.10.1
9.10.2
9.10.3
9.11.0
9.11.1
9.11.2
9.2.0
9.2.1
9.3.0
9.3.1
9.4.0
9.5.0
9.5.1
9.5.2
9.5.3
9.5.4
9.5.5
9.6.0
9.7.0
9.7.1
9.8.0
9.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82521.json"