CVE-2026-29962

High

Published: 18/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Risk Assessment

This vulnerability allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure.

Recommendation

It is recommended to implement proper validation and sanitization mechanisms for user-supplied file paths and restrict access to critical system files.

Other vulnerabilities in HSC MailInspector v5.3.3-7

CVE-2026-29963High
HSC MailInspector version 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory.

Original NVD description (English source)

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure.