id: PYSEC-2026-558
published: "2026-06-29T11:50:51.107727Z"
modified: "2026-07-01T20:23:10.814686Z"
aliases:
- CVE-2025-64712
- GHSA-gm8q-m8mv-jj5m
summary: Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
details: "A Path Traversal vulnerability in the `partition_msg` function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments.\n\n  ## Impact\n  An attacker can craft a malicious .msg file with attachment filenames containing path traversal sequences (e.g.,\n  `../../../etc/cron.d/malicious`). When processed with `process_attachments=True`, the library writes the attachment to an\n  attacker-controlled path, potentially leading to:\n\n  - Arbitrary file overwrite\n  - Remote code execution (via overwriting configuration files, cron jobs, or Python packages)\n  - Data corruption\n  - Denial of service\n\n  ## Affected Functionality\n  The vulnerability affects the MSG file partitioning functionality when `process_attachments=True` is enabled.\n\n  ## Vulnerability Details\n  The library does not sanitize attachment filenames in MSG files before using them in file write operations, allowing directory\n  traversal sequences to escape the intended output directory.\n\n  ## Workarounds\n  Until patched, users can:\n  - Set `process_attachments=False` when processing untrusted MSG files\n  - Avoid processing MSG files from untrusted sources\n  - Implement additional filename validation before processing"
affected:
- package:
    name: unstructured
    ecosystem: PyPI
    purl: pkg:pypi/unstructured
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.18.18
  versions:
  - 0.0.1.dev0
  - 0.10.0
  - 0.10.1
  - 0.10.10
  - 0.10.11
  - 0.10.12
  - 0.10.13
  - 0.10.14
  - 0.10.15
  - 0.10.16
  - 0.10.18
  - 0.10.19
  - 0.10.19.dev18
  - 0.10.2
  - 0.10.20
  - 0.10.21
  - 0.10.22
  - 0.10.23
  - 0.10.24
  - 0.10.25
  - 0.10.26
  - 0.10.27
  - 0.10.28
  - 0.10.29
  - 0.10.30
  - 0.10.4
  - 0.10.5
  - 0.10.6
  - 0.10.7
  - 0.10.8
  - 0.10.9
  - 0.11.0
  - 0.11.1
  - 0.11.2
  - 0.11.4
  - 0.11.5
  - 0.11.6
  - 0.11.7
  - 0.11.8
  - 0.12.0
  - 0.12.2
  - 0.12.3
  - 0.12.4
  - 0.12.5
  - 0.12.6
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.13.3
  - 0.13.4
  - 0.13.5
  - 0.13.6
  - 0.13.7
  - 0.14.0
  - 0.14.10
  - 0.14.2
  - 0.14.2.dev1
  - 0.14.3
  - 0.14.4
  - 0.14.5
  - 0.14.6
  - 0.14.7
  - 0.14.8
  - 0.14.9
  - 0.15.0
  - 0.15.1
  - 0.15.10
  - 0.15.12
  - 0.15.13
  - 0.15.14
  - 0.15.3
  - 0.15.5
  - 0.15.6
  - 0.15.7
  - 0.15.8
  - 0.15.9
  - 0.16.0
  - 0.16.1
  - 0.16.10
  - 0.16.11
  - 0.16.12
  - 0.16.13
  - 0.16.14
  - 0.16.15
  - 0.16.16
  - 0.16.17
  - 0.16.19
  - 0.16.2
  - 0.16.20
  - 0.16.21
  - 0.16.22
  - 0.16.23
  - 0.16.24
  - 0.16.25
  - 0.16.3
  - 0.16.4
  - 0.16.5
  - 0.16.6
  - 0.16.7
  - 0.16.8
  - 0.16.9
  - 0.17.0
  - 0.17.2
  - 0.18.1
  - 0.18.11
  - 0.18.13
  - 0.18.14
  - 0.18.15
  - 0.18.2
  - 0.18.3
  - 0.18.5
  - 0.18.6
  - 0.18.7
  - 0.18.9
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.2.3
  - 0.2.4
  - 0.2.5
  - 0.2.6.dev1
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.3.4
  - 0.3.5
  - 0.4.0
  - 0.4.1
  - 0.4.10
  - 0.4.11
  - 0.4.12
  - 0.4.13
  - 0.4.14
  - 0.4.15
  - 0.4.16
  - 0.4.2
  - 0.4.3
  - 0.4.4
  - 0.4.6
  - 0.4.7
  - 0.4.8
  - 0.4.9
  - 0.5.0
  - 0.5.1
  - 0.5.10
  - 0.5.11
  - 0.5.12
  - 0.5.13
  - 0.5.2
  - 0.5.3
  - 0.5.4
  - 0.5.6
  - 0.5.7
  - 0.5.8
  - 0.5.9
  - 0.6.0
  - 0.6.1
  - 0.6.10
  - 0.6.11
  - 0.6.2
  - 0.6.3
  - 0.6.4
  - 0.6.5
  - 0.6.6
  - 0.6.7
  - 0.6.8
  - 0.6.9
  - 0.7.0
  - 0.7.1
  - 0.7.10
  - 0.7.11
  - 0.7.12
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - 0.7.8
  - 0.7.9
  - 0.8.0
  - 0.8.1
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 0.8.8
  - 0.9.0
  - 0.9.1
  - 0.9.2
  - 0.9.3
references:
- type: WEB
  url: https://github.com/Unstructured-IO/unstructured/security/advisories/GHSA-gm8q-m8mv-jj5m
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2025-64712
- type: WEB
  url: https://github.com/Unstructured-IO/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d
- type: PACKAGE
  url: https://github.com/Unstructured-IO/unstructured
- type: PACKAGE
  url: https://pypi.org/project/unstructured
- type: ADVISORY
  url: https://github.com/advisories/GHSA-gm8q-m8mv-jj5m
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H