EUVD-2026-30783
GHSA-wcm2-h52j-8wcv
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionNVD
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.
AnalysisAI
Unauthenticated path traversal in HSC MailInspector 5.3.3-7 allows remote attackers to read arbitrary files from the underlying operating system by manipulating the 'text' parameter of the /tap/dw.php endpoint. Public exploit details are disclosed on GitHub (sql3t0/cve-disclosures), though EPSS probability remains low (0.05%) and the issue is not currently listed in CISA KEV. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running HSC MailInspector 5.3.3-7 or earlier and verify their network exposure. Within 7 days: Restrict access to the /tap/dw.php endpoint via firewall rules; deploy WAF rules to block path traversal patterns in the 'text' parameter; enable detailed logging on file access attempts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today