CVE-2026-29780: 
Python vulnerability analysis and mitigation

CVE-2026-29780 is a path traversal vulnerability (CWE-22) in the official example script examples/recursively_extract_attachments.py of the GOVCERT-LU eml_parser Python library. The flaw allows an attacker to achieve arbitrary file write outside the intended output directory by supplying a crafted email with a malicious attachment filename. All versions of eml-parser (pip) prior to 2.0.1 are affected; the core library itself is not impacted. The vulnerability was responsibly disclosed by researcher "redyank" on February 13, 2026, with the advisory published on March 4, 2026, and patched in version 2.0.1. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, GOVCERT-LU Advisory).

The root cause is improper neutralization of path traversal sequences (CWE-22) in examples/recursively_extract_attachments.py. Specifically, lines 61–64 of the script directly concatenate the attacker-controlled a['filename'] value — extracted from the email's Content-Disposition header — with the output path using Python's pathlib / operator, with no sanitization, normalization, or boundary validation performed before writing the file. An attacker crafts an .eml file with a Content-Disposition header such as filename="../../etc/cron.d/backdoor", which causes the script to write file content to an arbitrary location on the filesystem. Exploitation requires a user to run the vulnerable example script against the malicious email, making user interaction a prerequisite (GitHub Advisory, GOVCERT-LU Advisory, Patch Commit).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the process running the script, limited only by the OS-level permissions of the executing user. High-impact scenarios include cron job injection (../../etc/cron.d/backdoor), web shell upload (../../var/www/html/shell.php), and SSH authorized key injection (../../home/user/.ssh/authorized_keys), any of which could lead to persistent unauthorized code execution or privilege escalation. There is no direct confidentiality or availability impact, but integrity is fully compromised within the execution context (GitHub Advisory, GOVCERT-LU Advisory).

A public proof-of-concept exploit is available on GitHub at https://github.com/redyank/CVE-2026-29780, published around March 10, 2026. There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (1st percentile), indicating a low probability of exploitation in the near term. No threat actor attribution has been reported (GitHub Advisory, PoC).

1. Craft a malicious .eml file: Create an email file with an attachment whose Content-Disposition header contains a path traversal filename, e.g., Content-Disposition: attachment; filename="../../etc/cron.d/backdoor". Include arbitrary content as the attachment body (base64-encoded).
2. Deliver the email: Place the crafted .eml file in a directory that will be processed by the target running the vulnerable recursively_extract_attachments.py script (e.g., an email inbox folder monitored by the script).
3. Trigger script execution: Wait for or induce the target user or automated process to run python recursively_extract_attachments.py -p ./emails -o ./safe against the directory containing the malicious email.
4. Achieve arbitrary file write: The script extracts a['filename'] directly from the parsed email without sanitization and constructs out_filepath = out_path / a['filename'], writing the attacker-controlled content to the traversed path (e.g., /etc/cron.d/backdoor) outside the intended output directory.
5. Achieve persistence or code execution: Depending on the written file (cron job, web shell, SSH key), the attacker gains persistent access or remote code execution on the target system (GitHub Advisory, GOVCERT-LU Advisory).

• File System: Unexpected files written outside the configured output directory when running recursively_extract_attachments.py; new or modified files in sensitive locations such as /etc/cron.d/, /var/www/html/, or ~/.ssh/authorized_keys with timestamps correlating to script execution; attachment filenames in processed emails containing ../ or ..\ sequences.
• Logs: Script output logs showing Writing attachment: entries with paths outside the intended output directory; Python tracebacks or permission errors when the traversal target is write-protected.
• Network: Outbound connections from the host following script execution (indicative of a dropped web shell or cron-based reverse shell being triggered).
• Process: Unexpected cron job execution or new SSH sessions originating from accounts that should not have authorized keys, occurring shortly after email processing (GitHub Advisory).

Upgrade eml-parser (pip) to version 2.0.1 or later, which includes the patched recursively_extract_attachments.py that uses pathlib.Path(a['filename']).name to strip directory components and validates that the resolved output path remains within the intended output directory (Patch Commit). As an immediate workaround, disable or remove the example script if it is not actively needed, or manually apply the recommended fix: use os.path.basename() on filenames and validate that out_filepath.resolve().is_relative_to(out_path.resolve()) before writing. Additionally, restrict the OS-level write permissions of the user account running the script to limit the blast radius of any path traversal attempt (GitHub Advisory, GOVCERT-LU Advisory).

The vulnerability was reported through responsible disclosure by researcher "redyank" via GitHub issue #88 on February 13, 2026, and the maintainer (sim0nx) responded promptly, publishing the advisory and patch on March 4, 2026. Red Hat acknowledged the CVE on March 9, 2026. Community reaction has been limited given the moderate severity and narrow scope (example script only), with no significant media coverage or notable researcher commentary beyond the initial disclosure (GOVCERT-LU Issue, Red Hat CVE).