CRITICAL 9.2 NVD
CVE-2026-100389
GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file e
GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.
References
- https://gestsup.fr/index.php?page=changelog
- https://gestsup.fr/index.php?page=download
- https://www.vulncheck.com/advisories/gestsup-before-3.2.61-remote-code-execution-via-imap-
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-09-25 via NVD.
Risk Timeline
CVE Disclosed2026-09-25 · -1 days ago
Remediation Resources
Analysis & PoC
gestsup.fr/index.php?page=changelogAnalysis & PoC
gestsup.fr/index.php?page=download
vulnfeed aggregates 11568 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.