Skip to content

Version 6.1.4

Choose a tag to compare

View all tags
@Sicos1977 Sicos1977 released this 08 Oct 08:12
· 3 commits to master since this release
6.1.4
70dd199
  • Fixes a path traversal issue

Reader.ExtractToFolder writes each attachment of a parsed .msg or .eml email to outputFolder + attachment.FileName. For attachments unpacked from an embedded TNEF (winmail.dat) part the filename is taken straight from the TNEF stream and never passes through the RemoveInvalidFileNameChars sanitiser that normal MAPI and MIME attachment names do. So a crafted email can give a TNEF attachment a filename containing ../ segments and have the extracted file written outside the output folder, with attacker-chosen contents.

Assets 2
Loading