GestSup CVE-2026-100389

Requires the GestSup 'basic IMAP connector' to be configured and actively polling a monitored mailbox (email-to-ticket ingestion) - this is the concrete precondition captured by AT:P. The attacker sends an email with a PHP attachment; the connector fails to skip the blocked extension and stores it under the web-accessible upload/ticket directory. Execution additionally requires that the stored file be requested via HTTP, so the upload path must be reachable and locatable. No authentication (PR:N) and no victim interaction (UI:N) are needed, but exploitation is limited to deployments running the IMAP connector on GestSup versions before 3.2.61; installations without email ingestion are not exposed.

This is a genuinely high-priority vulnerability by technical impact: unauthenticated remote code execution (CVSS 4.0 9.2, VC:H/VI:H/VA:H) requiring no privileges and no user interaction. The one signal that tempers raw severity is AT:P (Attack Requirements: Present), which reflects that the basic IMAP connector must be configured and actively monitoring a mailbox, and that the written PHP file must subsequently be accessed to execute - this is a real deployment/timing gate rather than a fire-and-forget exploit. A patch is available from the vendor (3.2.61), and the advisory originates from VulnCheck, a credible source. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so per available signals this is 'no public exploit identified at time of analysis' - exploitation is not confirmed in the wild. The overall picture is a serious, easily-weaponizable file-upload-to-RCE bug in a niche product: high impact and low complexity, but bounded real-world footprint and no evidence yet of active or automated exploitation. Missing EPSS/KEV/POC data is an absence of signal, not proof of low risk; defenders running the IMAP connector should patch promptly.

An attacker emails a PHP file as an attachment to a mailbox monitored by GestSup's basic IMAP connector. GestSup fails to skip the blocked extension and writes the attachment into the web-accessible upload/ticket directory; the attacker then requests that file's URL, causing the PHP to execute on the server as the web user. No authentication or user interaction is required, though the IMAP connector must be configured and the uploaded path must be reachable/guessable; no public POC is identified in the provided data.