Technical impact
GestSup versions prior to 3.2.62 expose unauthenticated attackers to remote code execution via the IMAP attachment handling. The flaw arises because the basic IMAP connector fails to reject attachments with blocked file extensions. When attackers submit emails containing PHP files to monitored mailboxes, the attachments are written to the web‑accessible upload/ticket directory and can be executed when accessed. This vulnerability maps to CWE‑434 and can compromise confidentiality, integrity, and availability on affected systems.
Affected Systems
The affected product is GestSup earlier than version 3.2.62; all deployments of GestSup running a version before 3.2.62 are vulnerable. The vendor identifier is GestSup, with the product named GestSup. No specific sub‑version range is defined beyond the advisory notice of the 3.2.62 release.
Risk and Exploitability
The CVSS score of 9.2 labels this flaw as critical, and the lack of authentication requirements combined with the ability to write executable files directly to a web‑root folder make exploitation practical. The updated EPSS score remains less than 1%, indicating a low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the remote code execution capability permits an attacker to execute arbitrary code on the server once a PHP payload has been delivered and accessed. Because any mailbox monitored by the compromised GestSup instance can be targeted, the threat is broad and immediate compromise of the underlying host is possible.
