CVE-2026-29962

Vulnerability

HSC MailInspector version 5.3.3-7 contains a Local File Inclusion (LFI) vulnerability in the endpoint /vendor/phpunit/phpunit.php. The endpoint processes user-controlled parameters that directly affect file access operations without adequate validation or path restriction, enabling path traversal attacks. This issue is classified under CWE-73 (External Control of File Name or Path) [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication or user interaction. By sending a crafted HTTP request to /vendor/phpunit/phpunit.php with path traversal sequences (e.g., ../) in the file parameter, the attacker can read arbitrary files from the server's filesystem [2].

Impact

Successful exploitation allows an attacker to read sensitive system and application files, including configuration files, credentials, API keys, and database connection details. This information disclosure can provide insight into the internal architecture of the server and serve as a stepping stone for further attacks [2].

Mitigation

As of the publication date, no official patch or workaround has been disclosed in the available references. Administrators are advised to monitor vendor updates and restrict network access to the vulnerable endpoint, or implement input validation and path sanitization as a temporary measure [2].