Executive Summary
A remote code execution vulnerability (CVE-2026-100389) has been disclosed in GestSup, an open-source PHP helpdesk and ticketing system. The flaw lives in GestSup's basic IMAP connector, which ingests incoming email into monitored support mailboxes to auto-create tickets. The connector fails to block dangerous file extensions on attachments, allowing an unauthenticated attacker to simply email a PHP file to a monitored mailbox. The attachment is written into a web-accessible upload/ticket directory and can then be executed by requesting it directly over HTTP.
CVSS Score: 8.1 (High) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (some trackers also list an alternate CVSS 4.0 score of 9.2, Critical)
No authentication, no valid support account, and no interaction from the helpdesk operator is required beyond the IMAP connector doing its normal job of polling the mailbox — sending the email is enough to place a webshell on the server. A fix is available in GestSup 3.2.61.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-100389 |
| CVSS Score | 8.1 (High) |
| CWE | CWE-434 — Unrestricted Upload of File with Dangerous Type |
| Type | Unauthenticated Remote Code Execution via File Upload |
| Attack Vector | Network (email to a monitored mailbox) |
| Privileges Required | None |
| User Interaction | None |
| Condition | Basic IMAP connector enabled and polling a monitored mailbox |
| Assigner | VulnCheck |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| GestSup | prior to 3.2.61 | 3.2.61 |
Attack Vector
1. Attacker identifies a GestSup deployment with the basic IMAP connector
enabled against a monitored support mailbox (e.g. support@victim.tld)
2. Attacker sends an email to that mailbox with a PHP file attached
(e.g. disguised as an "invoice" or "screenshot")
3. The IMAP connector polls the mailbox, ingests the message to open a
ticket, and saves the attachment — without checking for blocked/
dangerous file extensions
4. The PHP attachment is written into the web-accessible upload/ticket
directory under its original (or a predictable) filename
5. Attacker requests the uploaded file directly over HTTP
6. The web server executes the PHP payload — full remote code execution
on the helpdesk hostImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Remote Code Execution | Execute arbitrary PHP code on the server hosting GestSup |
| Ticket Data Exposure | Read/exfiltrate customer tickets, attachments, and support history |
| Credential Theft | Access database credentials and mail account secrets from GestSup's config |
| Webshell Persistence | Dropped webshells can persist across ticket cleanup and application updates |
| Lateral Movement | Pivot to other services sharing the host or network segment |
| No Authentication Needed | Exploitation only requires the ability to send an email to the monitored address |
Immediate Remediation
Step 1: Update to Version 3.2.61
Upgrade GestSup to 3.2.61 or later, where the IMAP connector's attachment handling correctly enforces the blocked-extension list. Check the vendor changelog for the current release:
# Compare your installed version against the vendor changelog
# https://gestsup.fr/index.php?page=changelogStep 2: Audit the IMAP Connector Configuration
- Open GestSup's mail connector settings
- Confirm the basic IMAP connector is only enabled where genuinely needed
- Review the monitored mailbox address(es) for unnecessary public exposure
Step 3: Scan for Existing Compromise
# Search the ticket/upload directory for unexpected PHP (or other
# executable) files
find /path/to/gestsup/upload -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.php5" \)
# Check for common webshell signatures
grep -rl "eval\s*(base64_decode" /path/to/gestsup/upload/
grep -rl "system\s*(\|shell_exec\s*(\|passthru\s*(" /path/to/gestsup/upload/
# Review recent ticket attachments ingested via the IMAP connector for
# suspicious filenames or double extensions (e.g. invoice.pdf.php)If Immediate Patching Is Not Possible
- Disable the basic IMAP connector until the upgrade is applied
- Block script execution in the upload/ticket directory at the web-server level (e.g.
php_admin_flag engine off, or an Nginx location block denying.phpexecution under/upload/) - Deploy a WAF rule to flag inbound requests for newly created files in the ticket upload path
- Restrict mailbox access — ensure only the intended sender addresses can reach the monitored inbox where feasible
Detection Indicators
| Indicator | Description |
|---|---|
| New PHP files in the ticket/upload directory | Possible successful exploitation |
| HTTP requests to newly ingested attachment paths | Attacker retrieving/executing an uploaded webshell |
| Unexpected emails to the monitored mailbox with executable attachments | Exploitation attempt in progress |
| Outbound connections or unexpected child processes from the web server | Post-exploitation activity |
Post-Remediation Steps
- Confirm GestSup is updated to 3.2.61 or later
- Re-scan the upload/ticket directory for webshells and unauthorized files
- Review ticket history for tickets created from unrecognized senders around the exposure window
- Rotate credentials — GestSup admin accounts, database credentials, and the monitored mailbox password
- Enable extension allow-listing (not just deny-listing) for attachment ingestion if GestSup's configuration supports it
- Deploy file-integrity monitoring on the upload/ticket directory going forward
References
- VulnCheck — GestSup before 3.2.61 Remote Code Execution via IMAP Attachment
- GestSup Official Changelog
- NIST NVD — CVE-2026-100389