PT-2026-20900 · Gfi · Gfi Mailessentials

Alex Williams + 1 · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-23620

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description GFI MailEssentials AI versions before 22.4 have a flaw that allows authenticated users to check for the existence of arbitrary files on the server. This is possible through the ListServer.IsDBExist() web method, accessible at the ''/MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist'' API endpoint. The vulnerability occurs because an attacker can provide an unrestricted filesystem path via the path JSON key. This path is then URL-decoded and used in a File.Exists() function call, enabling file existence enumeration.

Recommendations Update GFI MailEssentials AI to version 22.4 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2026-23620

Affected Products

Gfi Mailessentials

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-23620 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23620 · Vendor Advisory
• https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases · Patch
• https://t.me/CVEtracker/45162 · Telegram Post
• https://twitter.com/CVEnew/status/2025809108105068701 · Twitter Post
• https://vulncheck.com/advisories/gfi-mailessentials-ai-listserver-isdbexist-absolute-directory-traversal-to-file-enumeration · Note