CVE-2026-29780: eml_parser path traversal in example script

CVE-2026-29780 · Severity: low · CVSS 3.1 · Published 2026-03-07

The eml_parser library includes an example script for extracting email attachments that fails to validate attachment filenames before writing them to disk. An attacker can craft a malicious email with a specially-crafted filename (e.g., "../../../etc/cron.d/backdoor") to write files outside the intended directory, potentially enabling code execution or system compromise through injection into sensitive system locations.

Technologies: GOVCERT-LU Eml Parser, eml-parser (PyPI). Vendors: GOVCERT-LU, PyPI.

Quick answers

Is CVE-2026-29780 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29780 being exploited in the wild.
How severe is CVE-2026-29780?
Low severity, with a CVSS score of 3.1, published 7 March 2026.
Which products and versions are affected?
GOVCERT-LU Eml Parser before 2.0.1; eml-parser (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.1.
Is there a fix for CVE-2026-29780?
Yes. eml-parser (PyPI): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29780 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-29780?
Check whether you run GOVCERT-LU Eml Parser or eml-parser (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • eml-parser (PyPI): upgrade to 2.0.1 or later
    pip install "eml-parser>=2.0.1"

Technical details

The vulnerability is a path traversal flaw (CWE-22) in the official example script examples/recursively_extract_attachments.py (lines 61–64). Attachment filenames extracted from email Content-Disposition headers are directly used in pathlib.Path construction without sanitization or normalization. An attacker-controlled filename containing traversal sequences (../) can escape the target output directory. The attack requires local execution of the vulnerable script and user interaction (running the script against a crafted email), but no elevated privileges. An attacker can write arbitrary files within the execution context's filesystem permissions, potentially leading to cron job injection, web shell upload, or SSH key injection. The vulnerability was patched in version 2.0.1 with proper path normalization and boundary validation using os.path.basename() and Path.is_relative_to().

Affected products

  • GOVCERT-LU eml_parser before 2.0.1

Identifiers

  • CVE-2026-29780
  • GHSA-389r-rccm-h3h5
  • PYSEC-2026-2148

Timeline

  • 2026-03-05: disclosed
  • 2026-03-05: patched: Version 2.0.1 released with fix
  • 2026-03-07: advisory: NVD published CVE-2026-29780

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.