PT-2026-20910 · Gfi · Gfi Mailessentials

Alex Williams + 1 · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-23621

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description The software contains an arbitrary directory existence enumeration issue in the ListServer.IsPathExist() web method, accessible via the API endpoint '/MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist'. An authenticated user can provide an unrestricted filesystem path through the JSON key path, which is URL-decoded and then used in the Directory.Exists() function. This allows an attacker to determine if arbitrary directories exist on the server.

Recommendations Update to version 22.4 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2026-23621

Affected Products

Gfi Mailessentials

References · 5

• https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases · Patch
• https://osv.dev/vulnerability/CVE-2026-23621 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23621 · Security Note
• https://twitter.com/CVEnew/status/2025809107199091002 · Twitter Post
• https://vulncheck.com/advisories/gfi-mailessentials-ai-listserver-ispathexist-absolute-directory-traversal-to-file-enumeration · Note