CVE-2026-100389

HIGH 8.1

GestSup before 3.2.61 Remote Code Execution via IMAP Attachment

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.

CWE	CWE-434
Vendor	gestsup
Product	gestsup
Published	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for gestsup gestsup

Be the first to know when new high vulnerabilities affecting gestsup gestsup are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

GestSup / GestSup

0 < 3.2.61

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gestsup.fr: https://gestsup.fr/index.php?page=changelog gestsup.fr: https://gestsup.fr/index.php?page=download vulncheck.com: https://www.vulncheck.com/advisories/gestsup-before-3.2.61-remote-code-execution-via-imap-attachment

Credits

SpiizN