TI-2026-64662 Aliases CVE-2026-100389 GHSA-3p62-2wp9-6rpj

GestSup before 3.2.62 Remote Code Execution via IMAP Attachment

MEDIUM 42CWE-434Published 2026-09-25 · Updated 2026-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible upload/ticket directory and executed when accessed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0058 47th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed GestSup (GestSup): 3.2.62

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GestSup	GestSup	before 3.2.62	3.2.62	Patch available	CNA

GestSup VendorGestSup Affected before 3.2.62 Fixed in 3.2.62 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:gestsup:gestsup::::::::	—	—	GestSup

cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:* Versions — — ·GestSup

Remediation

Fix · CNA GestSup (GestSup) Fixed in 3.2.62

Timeline

2026-10-02 Threatist record created from CVE-2026-100389
2026-10-03 Alias added: GHSA-3p62-2wp9-6rpj

References

Exploit 1

https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/

Other 2

TI-2026-65370 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter CVSS 4.0HIGH 7.1
TI-2023-28509 A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute… CVSS 3.1MEDIUM 5.4
TI-2023-28510 A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily… CVSS 3.1MEDIUM 4.3
TI-2021-11728 Gestsup before 3.2.10 allows account takeover through the password recovery functionality… CVSS 3.1CRITICAL 9.8
TI-2026-17804 GestSup <= 3.2.60 CSRF Allows Privileged Actions CVSS 4.0HIGH 8.9
TI-2026-17806 GestSup < 3.2.60 SQL Injection in Ticket Creation CVSS 4.0HIGH 7.7

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences