CVE-2026-100389
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP…
- Risk score
- 63/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directo…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.2.62 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.
Last activity 25 Sep 2026. Patch Forecast updates every hour.