---
id: CVE-2026-82521
title: >-
  parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an
  output path derived from the email subject
summary: >-
  parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an
  output path derived from the email subject. When the subject consists entirely
  of path traversal sequences, the filename sanitization function produces an
  empty …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-22
vendor: domainaware
product: parsedmarc
affected:
  - parsedmarc >= 9.0.6 < 11.0.1
published: '2026-09-03'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82521'
references:
  - url: 'https://github.com/domainaware/parsedmarc/releases/tag/11.0.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/domainaware/parsedmarc/security/advisories/GHSA-c284-w5m6-jhjm
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/parsedmarc-path-traversal-via-forensic-report-subject
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00429
epssPercentile: 0.34514
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T13:07:05.542319Z'
ingestedAt: '2026-09-14T15:23:07.411Z'
---

## Overview

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.