CVE-2026-100389

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.

CVSS 4.0

9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-25)

CWE

CWE-434

Published

2026-09-25

Modified

2026-09-30

Record from

the NVD, synced 2026-10-19

References

• https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/
• https://gestsup.fr/index.php?page=changelog
• https://gestsup.fr/index.php?page=download
• https://www.vulncheck.com/advisories/gestsup-before-3.2.61-remote-code-execution-via-imap-attachment

Check your stackJSON