CVE-2026-29780 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write
Attackers can write arbitrary files outside the intended directory via malicious email attachments when using the vulnerable example script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-29780?
CVE-2026-29780 is a medium-severity path traversal vulnerability in GOVCERT-LU eml_parser, published on 7 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursively_extract_attachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted from parsed emails are directly used to construct output file paths without any sanitization, allowing an attacker-controlled filename to escape the target directory. This issue has been patched in version 2.0.1.
Weakness: CWE-22
Which versions are affected by CVE-2026-29780?
3 open source packages ship an affected version, including eml-parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
eml-parser PyPI | All versions | 2.0.1 |
eml-parser PyPI | All versions | 2.0.1 |
eml-parser PyPI | All versions | 2.0.1 |
Products include Govcert.lu Eml Parser.
How do I fix CVE-2026-29780?
Upgrade eml-parser to 2.0.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-29780 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29780 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-389r-rccm-h3h5, PYSEC-2026-2148.