A path traversal vulnerability was identified in mail-parser when extracting email attachments using the write_attachments() and write_sample() APIs.
A specially crafted email containing malicious attachment filenames (for example, using directory traversal sequences such as "../" or absolute filesystem paths) could cause files to be written outside the intended output directory. Depending on how the library was used and the permissions of the executing process, this could result in arbitrary file overwrite.
The vulnerability affects mail-parser versions 3.8.0 through 4.5.0.
The issue has been addressed by introducing comprehensive filename sanitization and path validation before any file is written to disk. The fix includes:
- Sanitization of attachment filenames before writing.
- Validation that all output paths remain within the intended destination directory.
- Rejection of symbolic link targets.
- Normalization of Windows and POSIX path separators.
- Validation and rejection of invalid or unsafe filenames.
- Protection applied consistently in both write_attachments() and write_sample() APIs.
Users are strongly encouraged to upgrade to the patched release.
Credits
The vulnerability was responsibly reported by Niranjan Ganesan (Security Insights, https://securityinsights.io/, GitHub: @iam-niranjan).
The vulnerability was analyzed, remediated, and the security fix was implemented by Fedele Mantuano, maintainer of mail-parser (LinkedIn: https://www.linkedin.com/in/fmantuano/).
We would like to thank Niranjan Ganesan for following a coordinated vulnerability disclosure process and for collaborating throughout the remediation and verification of the fix.
fedelemantuano Remediation developer
iam-niranjan Reporter
A path traversal vulnerability was identified in mail-parser when extracting email attachments using the write_attachments() and write_sample() APIs.
A specially crafted email containing malicious attachment filenames (for example, using directory traversal sequences such as "../" or absolute filesystem paths) could cause files to be written outside the intended output directory. Depending on how the library was used and the permissions of the executing process, this could result in arbitrary file overwrite.
The vulnerability affects mail-parser versions 3.8.0 through 4.5.0.
The issue has been addressed by introducing comprehensive filename sanitization and path validation before any file is written to disk. The fix includes:
Users are strongly encouraged to upgrade to the patched release.
Credits
The vulnerability was responsibly reported by Niranjan Ganesan (Security Insights, https://securityinsights.io/, GitHub: @iam-niranjan).
The vulnerability was analyzed, remediated, and the security fix was implemented by Fedele Mantuano, maintainer of mail-parser (LinkedIn: https://www.linkedin.com/in/fmantuano/).
We would like to thank Niranjan Ganesan for following a coordinated vulnerability disclosure process and for collaborating throughout the remediation and verification of the fix.