Aerc Directory Traversal Vulnerability in Attachment Handling

A directory traversal vulnerability has been identified in Aerc versions prior to the commit 93bec0d. The issue arises in the 'commands/msgview/open.go' file, where the application improperly concatenates paths for attachment filenames. This flaw allows for traversal sequences to be introduced, potentially leading to unauthorized file access.

Impact

Exploitation of this vulnerability could result in directory traversal, allowing attackers to access files and directories outside of the intended scope.

Reproduction

The vulnerability can be reproduced by opening an attachment with a filename that includes directory traversal sequences. Aerc will attempt to process the attachment by concatenating the path, which can lead to accessing unintended files or directories.

Remediation

Users can update to the latest version of Aerc, where this vulnerability has been addressed.