PT-2026-41706 · Unknown · Hc Mailinspector

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-29963

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HSC MailInspector version 5.3.3-7

Description Improper validation of user-supplied input in the '/tap/dw.php' endpoint allows a remote attacker to access arbitrary files on the underlying operating system, leading to unauthorized disclosure of sensitive information. This occurs because the text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. Path Traversal is a flaw where an attacker can access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the text parameter in the '/tap/dw.php' endpoint until the issue is resolved.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29963

Affected Products

Hc Mailinspector

References · 5

• 🔥 https://github.com/sql3t0/cve-disclosures · Exploit
• 🔥 https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29963 · Security Note
• https://t.me/CVEtracker/54146 · Telegram Post
• https://hsclabs.com/pt-br/mailinspector · Note