PT-2026-41705 · Hsc · Hc Mailinspector

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-29962

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HSC MailInspector version 5.3.3-7

Description A Local File Inclusion (LFI) issue exists due to improper control of user-supplied file paths. The endpoint '/vendor/phpunit/phpunit.php' processes user-controlled parameters that affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to use Path Traversal—a technique used to access files and directories that are stored outside the web root folder—to read arbitrary files from the application directories and the underlying operating system, resulting in the disclosure of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-29962

Affected Products

Hc Mailinspector

References · 5

• 🔥 https://github.com/sql3t0/cve-disclosures · Exploit
• 🔥 https://github.com/sql3t0/cve-disclosures/blob/main/01_-_CVE-2026-29962_LFI%2BPath_Traversal.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29962 · Security Note
• https://t.me/CVEtracker/54145 · Telegram Post
• https://hsclabs.com/pt-br/mailinspector · Note