Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. eml-parser
  4. ›
  5. CVE-2026-29780

CVE-2026-29780: eml_parser: Path Traversal in Official Example Script Leads to Arbitrary File Write

March 5, 2026 (updated March 9, 2026)

The official example script examples/recursively_extract_attachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted from parsed emails are directly used to construct output file paths without any sanitization, allowing an attacker-controlled filename to escape the target directory.

References

  • github.com/GOVCERT-LU/eml_parser
  • github.com/GOVCERT-LU/eml_parser/commit/99af03a09a90aaaaadd0ed2ffb5eea46d1ea2cc9
  • github.com/GOVCERT-LU/eml_parser/issues/88
  • github.com/GOVCERT-LU/eml_parser/security/advisories/GHSA-389r-rccm-h3h5
  • github.com/advisories/GHSA-389r-rccm-h3h5
  • nvd.nist.gov/vuln/detail/CVE-2026-29780

Code Behaviors & Features

Detect and mitigate CVE-2026-29780 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.0.1

Fixed versions

  • 2.0.1

Solution

Upgrade to version 2.0.1 or above.

Impact 5.5 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Source file

pypi/eml-parser/CVE-2026-29780.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 12:18:53 +0000.