High severity · published Sep 25, 2026
CVE-2026-100389
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GestSup · GestSup
before 3.2.62 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100389
release-notes
https://gestsup.fr/index.php?page=changelog
product
https://gestsup.fr/index.php?page=download
third-party-advisory
https://www.vulncheck.com/advisories/gestsup-before-3.2.61-remote-code-execution-via-imap-attachment
technical-description
https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/
More from GestSup
9.8
CVE-2021-31646
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote)
8.8
CVE-2026-22194
GestSup <= 3.2.60 CSRF Allows Privileged Actions
8.1
CVE-2026-22196
GestSup < 3.2.60 SQL Injection in Ticket Creation
8.1
CVE-2026-22197
GestSup < 3.2.60 Multiple SQL Injections in Asset List
8.1
CVE-2026-22195
GestSup < 3.2.60 SQL Injection in Search Bar