Parsedmarc versions prior to 11.0.1 can write forensic report sample files using a file name derived from the email subject. When the subject is composed solely of path‑traversal characters, the sanitization routine returns an empty string. A fallback then uses the raw subject, allowing a crafted file name to be written outside the intended samples directory. This flaw does not grant arbitrary code execution but enables an attacker to create or overwrite files in directories above the configured output location, potentially exposing or tampering with system files.

The vulnerability applies to domainaware:parsedmarc, specifically versions 9.0.6 through 10.x and any 10.x releases below 11.0.1. Upgrading to parsedmarc 11.0.1 or later removes the directory‑traversal issue.

The CVSS score of 6.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the forensic report sample output feature is enabled and that an attacker can trigger a forensic failure report with a crafted subject line, which typically means the attacker can send a specially crafted email to the system. Because the vulnerability does not allow arbitrary code execution, the risk is limited to unauthorized file creation and potential modification of sensitive files if the attacker can write to a privileged directory.