CVE-2025-64712: 
Python vulnerability analysis and mitigation

CVE-2025-64712 is a critical path traversal vulnerability in the partition_msg function of the Unstructured open-source Python library, which is widely used for ingesting and pre-processing documents (PDFs, HTML, Word docs, MSG files, etc.) in AI/ML pipelines. The vulnerability allows an unauthenticated attacker to write or overwrite arbitrary files on the filesystem by supplying a malicious MSG file with crafted attachment filenames. It affects all versions of the unstructured pip package up to and including 0.18.17, and was disclosed and patched on February 3, 2026. The CVSS v3.1 base score is 9.8 (Critical) (Github Advisory, GitHub Security Advisory).

The root cause is improper input validation classified under CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). The _AttachmentPartitioner class in unstructured/partition/msg.py used the raw file_name field from MSG attachment metadata directly in filesystem write operations without sanitizing path traversal sequences such as ../, absolute paths (e.g., /etc/passwd), Windows-style paths (e.g., C:\Windows\...), or null bytes. When partition_msg is called with process_attachments=True, the library extracts and writes each attachment to disk using the unsanitized filename, allowing an attacker to escape the intended output directory. The fix (commit b01d35b) applies os.path.basename() after normalizing backslashes, strips null bytes and control characters, and defaults to "unknown" for dangerous or empty filenames (GitHub Commit, Github Advisory).

Successful exploitation allows an unauthenticated attacker to write or overwrite arbitrary files anywhere on the filesystem accessible to the process running the library, with no user interaction required. This can lead to remote code execution by overwriting cron jobs, Python packages, or application configuration files; data corruption or destruction; confidentiality breaches by overwriting authentication or access control files; and denial of service. Given the library's widespread use in AI/ML document ingestion pipelines at organizations including major cloud providers, the blast radius is significant — compromising a document processing service could enable lateral movement into broader infrastructure (Github Advisory, GitHub Security Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.152% (36th percentile), indicating a relatively low near-term exploitation probability despite the critical severity rating (Github Advisory). However, the attack requires no authentication, no privileges, and no user interaction, making it trivially exploitable if an attacker can supply a malicious MSG file to a vulnerable processing pipeline.

1. Identify a target: Locate a service or application that uses the unstructured Python library (version ≤ 0.18.17) to process MSG files with process_attachments=True — common in AI document ingestion pipelines, email processing services, or data extraction APIs.
2. Craft a malicious MSG file: Create a valid .msg file (Outlook message format) and embed an attachment whose file_name metadata field contains a path traversal sequence, such as ../../../etc/cron.d/malicious or ../../../home/user/.ssh/authorized_keys.
3. Choose a payload: Determine the target file to overwrite based on the desired outcome — e.g., a cron job file for RCE, an SSH authorized_keys file for persistent access, or a Python package file (.py) for code injection.
4. Submit the malicious file: Deliver the crafted MSG file to the target application via any supported input channel (file upload endpoint, email processing queue, API call, etc.).
5. Trigger processing: Ensure the application calls partition_msg(filename=..., process_attachments=True), which causes the library to extract the attachment and write its contents to the attacker-controlled path on the filesystem.
6. Achieve objective: The overwritten file (e.g., a cron job or Python module) executes attacker-controlled content, resulting in RCE, persistence, or data exfiltration (Github Advisory, GitHub Security Advisory).

• File System: Unexpected or modified files in sensitive directories (e.g., /etc/cron.d/, /etc/cron.hourly/, ~/.ssh/authorized_keys, Python site-packages directories) with timestamps correlating to document processing activity; new files named unknown in document output directories (indicating sanitization bypass attempts on patched systems).
• Logs: Application logs showing partition_msg calls processing MSG files from untrusted or external sources; file write operations to paths outside the expected output directory in OS-level audit logs (e.g., auditd records for file creation/modification in sensitive paths by the application process).
• Process: Unexpected cron job execution or new scheduled tasks spawned after document processing events; unusual outbound network connections from the document processing service following MSG file ingestion.
• Network: Inbound delivery of .msg files with unusually large or structurally anomalous attachment metadata, particularly filenames containing ../, ..\, /etc/, C:\, or null bytes (%00) in raw message data.

Upgrade the unstructured pip package to version 0.18.18 or later, which sanitizes attachment filenames using os.path.basename() and strips null bytes and control characters before any filesystem write operation (Github Advisory, GitHub Commit). Until patching is complete, apply the following workarounds:

• Set process_attachments=False when calling partition_msg on untrusted MSG files.
• Restrict MSG file processing to trusted, internal sources only.
• Implement OS-level file access controls (e.g., chroot, seccomp, or AppArmor profiles) to limit where the application process can write files.
• Implement additional filename validation in application code before passing files to the library.

The vulnerability received notable coverage given the library's estimated 4 million downloads and its use in AI/ML pipelines at major technology companies. Security Online Info highlighted the risk with the headline "4 Million Downloads at Risk: Critical Unstructured Flaw (CVSS 9.8) Allows RCE" (Security Online). IT Security News and CyberPress covered the potential impact on Amazon, Google, and Fortune 1000 enterprises using the library in document processing workflows. The vulnerability was discussed on Reddit's r/netsec and shared across Mastodon and Bluesky infosec communities shortly after disclosure. The Hacker News included it in a weekly recap, and Ostorlab published a technical blog post analyzing the path traversal and RCE potential (Ostorlab Blog).