CVE-2025-64712: Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

February 3, 2026 (updated February 4, 2026)

A Path Traversal vulnerability in the partition_msg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments.

References

github.com/Unstructured-IO/unstructured
github.com/Unstructured-IO/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d
github.com/Unstructured-IO/unstructured/security/advisories/GHSA-gm8q-m8mv-jj5m
github.com/advisories/GHSA-gm8q-m8mv-jj5m
nvd.nist.gov/vuln/detail/CVE-2025-64712

Code Behaviors & Features

Detect and mitigate CVE-2025-64712 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →