eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

Vulnerability

Overview

eml_parser is a Python module for parsing .eml files. Prior to version 2.0.1, the official example script examples/recursively_extract_attachments.py contained a path traversal vulnerability that could lead to arbitrary file write outside the intended output directory. The root cause is the direct use of attacker-controlled attachment filenames (from Content-Disposition headers) to construct output file paths without any sanitization, as shown in the vulnerable code at lines 61–64 [3].

Exploitation

Details

An attacker can craft a malicious email with an attachment whose filename includes path traversal sequences such as ../outside/pwned.txt. When a victim runs the example script with this email, the script writes the attachment content to the resolved path, escaping the intended output directory. No authentication or special privileges are required beyond the ability to supply the email file to the script [1][3]. The proof-of-concept demonstrates writing to ../outside/pwned.txt instead of the intended ./safe/pwned.txt [3].

Impact

Successful exploitation allows an attacker to write arbitrary file content to any location the script's process can write. Potential attack scenarios include cron job injection via ../../etc/cron.d/backdoor, web shell upload to ../../var/www/html/shell.php, or SSH key injection into ../../home/user/.ssh/authorized_keys [3]. The vulnerability is limited to the example script and does not affect the core library, but the script is part of the official repository and often adapted for production use [1][3].

Mitigation

The issue has been patched in eml_parser version 2.0.1. The fix (commit 99af03a) resolves paths with pathlib.Path(...).resolve() and extracts only the filename component using .name, preventing traversal [4]. Users should update to version 2.0.1 or later, or avoid using the example script without applying equivalent sanitization [1][3].