5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29780

CVE-2026-29780: eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursively_extract_attachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted from parsed emails are directly used to construct output file paths without any sanitization, allowing an attacker-controlled filename to escape the target directory. This issue has been patched in version 2.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29780

CVE-2026-29780:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
eml-parser	pip	< 2.0.1	2.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue located in the example script examples/recursively_extract_attachments.py. The script is intended to demonstrate how to extract attachments from an email file. The root cause is the direct use of the attachment's filename, which is controllable by an attacker who sends a crafted email, to construct a file path for writing the attachment to disk. The patch 99af03a09a90aaaaadd0ed2ffb5eea46d1ea2cc9 confirms this by showing the modification in the main function. The vulnerable line out_filepath = out_path / a['filename'] is replaced with code that first sanitizes the filename by taking only its basename (pathlib.Path(a['filename']).name). This prevents directory traversal attacks. Therefore, any runtime profile during the exploitation of this vulnerability would show the main function as the execution context where the malicious file write occurs.

Vulnerable functions

main

examples/recursively_extract_attachments.py

The function `main` in the example script `recursively_extract_attachments.py` is vulnerable to path traversal. It constructs an output file path by directly concatenating a base directory (`out_path`) with a filename (`a['filename']`) extracted from an email attachment. Since the filename is not sanitized, an attacker can provide a malicious filename containing '..' sequences (e.g., '../../etc/passwd') to write files outside of the intended output directory. The vulnerability exists in the line `out_filepath = out_path / a['filename']` which was later patched to use `pathlib.Path(a['filename']).name` to safely extract the filename.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.