HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.
References
| Link | Resource |
|---|---|
| https://github.com/sql3t0/cve-disclosures | Third Party Advisory |
| https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md | Third Party Advisory |
| https://hsclabs.com/pt-br/mailinspector/ | Product |
Configurations
History
19 May 2026, 17:21
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hsclabs mailinspector
Hsclabs |
|
| References | () https://github.com/sql3t0/cve-disclosures - Third Party Advisory | |
| References | () https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md - Third Party Advisory | |
| References | () https://hsclabs.com/pt-br/mailinspector/ - Product | |
| CPE | cpe:2.3:a:hsclabs:mailinspector:5.3.3-7:*:*:*:*:*:*:* |
19 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-22 |
18 May 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-18 18:17
Updated : 2026-05-19 17:21
NVD link : CVE-2026-29963
Mitre link : CVE-2026-29963
CVE.ORG link : CVE-2026-29963
JSON object : View
Products Affected
hsclabs
- mailinspector
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')