What is the CVSS score of CVE-2026-29962?

CVE-2026-29962 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of HSC MailInspector are affected by CVE-2026-29962?

HSC MailInspector v5.3.3-7 contains an unauthenticated file disclosure vulnerability enabling external attackers to access sensitive files on email inspection systems without authentication.

How to fix or mitigate CVE-2026-29962?

Within 24 hours: Audit all HSC MailInspector v5.3.3-7 deployments and implement firewall or WAF rules to block external access to /vendor/phpunit/phpunit.php. Within 7 days: Contact HSC for interim hardening guidance and begin evaluation of alternative email security solutions. Within 30 days: Prepare upgrade or migration strategy and apply vendor patch immediately upon release (monitor HSC security advisories).

HSC MailInspector CVE-2026-29962

EUVD-2026-30781 HIGH

External Control of File Name or Path (CWE-73)

2026-05-18 mitre

GHSA-gx62-92q7-r437

Information Disclosure PHP Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 15:22 vuln.today

CVSS changed

May 19, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

May 18, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure.

AnalysisAI

Arbitrary file disclosure in HSC MailInspector v5.3.3-7 allows unauthenticated remote attackers to read sensitive files from the host via a path traversal flaw in the exposed /vendor/phpunit/phpunit.php endpoint. The CVSS 7.5 rating reflects high confidentiality impact with no required privileges or user interaction, though EPSS remains very low at 0.05% (15th percentile) and there is no public exploit identified at time of analysis. The exposure of a PHPUnit development artifact in a production path mirrors a long-standing class of PHP supply-chain misconfigurations.

Technical ContextAI

HSC MailInspector is a Brazilian email security and anti-spam gateway product from HSC Brasil (hsclabs.com), built on a PHP web stack. The root cause is CWE-73 (External Control of File Name or Path): the application ships PHPUnit's phpunit.php under a web-reachable /vendor/ directory, and user-controlled parameters are passed into file-access primitives without canonicalization, allow-listing, or chroot-style restriction. Because PHP's file functions resolve '../' sequences and absolute paths, an attacker can traverse outside the document root and read any file the PHP worker process can access (typically web user, but often including configuration, credentials, and OS files like /etc/passwd). Exposing the vendor/ directory at all is itself a known anti-pattern - Composer-managed dependencies are not meant to be reachable over HTTP.

RemediationAI

No vendor-released patch identified at time of analysis - HSC has not published a fixed version in the references provided. As compensating controls, block external HTTP access to the entire /vendor/ path at the reverse proxy or web server (e.g., an nginx 'location ^~ /vendor/ { deny all; }' or equivalent Apache rule), which is safe because Composer's vendor directory should never be web-reachable in production. Specifically deny /vendor/phpunit/phpunit.php and any *.php under /vendor/, and restrict the MailInspector management interface to trusted administrative networks via firewall or VPN. If the web user does not require broad filesystem read access, tighten its permissions and consider running PHP-FPM with open_basedir scoped to the application root to neutralize traversal beyond the app. Monitor web logs for requests to /vendor/phpunit/phpunit.php with traversal sequences (../, %2e%2e, absolute paths) and pull the vendor advisory at https://hsclabs.com/pt-br/mailinspector when published; the NVD entry is https://nvd.nist.gov/vuln/detail/CVE-2026-29962.