CVE-2026-82521: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in domainaware parsedmarc

In parsedmarc versions >=9.0.6 and <11.0.1, a path traversal vulnerability exists in the forensic report sample file writing functionality. The output filename is derived from the email subject, which is sanitized to prevent directory traversal. However, if the subject is composed solely of path traversal sequences, the sanitization results in an empty string, causing a fallback to the unsanitized subject. This fallback allows an attacker to write files outside the intended samples directory, potentially placing dot-prefixed files with attacker-controlled content in ancestor directories. Exploitation requires that forensic report sample file output is enabled and that an attacker can trigger a forensic failure report with a crafted subject.

An attacker able to cause a forensic failure report with a crafted email subject can write files outside the intended directory, potentially overwriting or creating files in ancestor directories. This could lead to unauthorized file creation or modification on the system running parsedmarc. The vulnerability does not require privileges or user interaction but does require the forensic report sample output feature to be enabled. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, consider disabling forensic report sample file output to prevent exploitation. Monitor vendor communications for an official fix or update to parsedmarc versions that address this vulnerability.