Path Traversal Vulnerability in Parsedmarc by DomainAware

CVE-2026-82521

What is CVE-2026-82521?

A significant security vulnerability in Parsedmarc allows for potential path traversal attacks when parsing forensic report subject lines. In versions prior to 11.0.1, if an email subject contains solely path traversal sequences, the output file's name becomes improperly sanitized, resulting in a risk of an unauthorized file being created outside the designated samples directory. Attackers can exploit this by crafting a malicious email subject to trigger this flaw, leading to the creation of files with attacker-controlled content in ancestor directories of the configured output path. This exploitation necessitates that file output for forensic report samples is enabled, making it crucial for users to upgrade to the patched version to mitigate this risk.

References