CVE-2026-29963
HighCVSS 7.5Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
HSC MailInspector version 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory.
Risk Assessment
A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.
Recommendation
It is recommended to implement proper validation and normalization of input data in the /tap/dw.php endpoint and restrict access to a safe base directory.
Other vulnerabilities in HSC MailInspector 5.3.3-7
See all- CVE-2026-29965Medium
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax.
- CVE-2026-29964Medium
HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding.
- CVE-2026-29962High
HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters, allowing unauthorized access to system files.
Original NVD description (English source)
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS