Executive brief
parsedmarc is a tool that processes DMARC authentication reports and forensic data from email systems. A path traversal vulnerability in versions 9.0.6 through 11.0.0 allows an attacker to write files outside the intended samples directory by crafting an email with a malicious Subject header. An attacker with the ability to send emails to a monitored mailbox can write arbitrary content to parent directories, potentially compromising the system's file structure and confidentiality.
Technical details
The vulnerability is a path traversal flaw in the save_output() function in parsedmarc/__init__.py. When writing forensic report sample files, the code derives the output filename from the email Subject header. The sanitization function get_filename_safe_string() removes path separators and trailing dots; when a subject consists entirely of path traversal sequences (e.g., ../../../), sanitization produces an empty string, triggering a fallback to the raw, unsanitized subject. This unsanitized subject is then passed to os.path.join() without containment verification, allowing directory traversal. An attacker can send a crafted email with Subject: ../../../ to a monitored mailbox; the resulting .eml file will be written to an ancestor directory determined by the number of ../ sequences. The attack requires that file output for forensic report samples is enabled, and the attacker must be able to send mail that reaches the monitored mailbox (low privilege requirement, network vector).
Affected products
- domainaware parsedmarc 9.0.6 through 11.0.0
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 11.0.1