{"action":"Upgrade sup-mail to 0.12.1+git20120407.aaa852f-1+deb7u1 or later.","affected":[{"fixed":"0.12.1+git20120407.aaa852f-1+deb7u1","introduced":"0"}],"component":"sup-mail","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.12.1+git20120407.aaa852f-1+deb7u1"],"id":"tcs_01M5NAHGRXTBR3Q7216MPWA3SN","modified_at":"2026-09-01T20:03:18.484014044Z","published_at":"2013-12-07T20:55:02.460Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2013-4478","https://security-tracker.debian.org/tracker/CVE-2013-4478"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2013-4478#Debian:13/sup-mail","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2013-4478"}],"summary":"Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment."}