CVE-2026-100389

Received Received - Intake

Remote Code Execution in GestSup via Malicious PHP Attachments

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100389

Affected Vendors & Products

Vendor	Product	Version / Range
gestsup	gestsup	to 3.2.61 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

GestSup versions before 3.2.61 have a remote code execution flaw in the IMAP connector's attachment handling. It fails to skip blocked file extensions, allowing unauthenticated attackers to send emails with PHP attachments to monitored mailboxes. These attachments are written to a web-accessible upload/ticket directory and executed when accessed.

Detection Guidance

Check for unexpected PHP files in the upload/ticket directory of GestSup installations. Monitor mail server logs for emails with PHP attachments sent to monitored mailboxes. Inspect web server access logs for unusual requests to the upload/ticket directory.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the affected system, potentially gaining full control. This could lead to data theft, system compromise, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade GestSup to version 3.2.61 or later. Block PHP attachments at the mail server level. Restrict write permissions to the upload/ticket directory. Disable direct web access to the upload/ticket directory if possible.

Hi! I’m here to help you understand CVE-2026-100389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70