A path traversal flaw in the official example script of eml_parser allows an attacker to supply a crafted attachment filename that writes data outside the intended output directory, enabling overwriting arbitrary files or creating files in unauthorized locations.

This vulnerability affects the GOVCERT‑LU eml_parser package prior to version 2.0.1; the insecure example script tests attachments without sanitizing filenames.

The vulnerability scores a moderate CVSS 5.5 and has an EPSS of less than 1%, indicating a low probability of exploitation. It is not listed in the CISA KEV catalog, and exploitation requires a user to execute the example script or for a malicious email to be processed by it, which limits the attack surface.