What is the CVSS score of CVE-2026-29963?

CVE-2026-29963 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of HSC MailInspector are affected by CVE-2026-29963?

HSC MailInspector versions 5.3.3-7 and earlier contain an unauthenticated remote file disclosure vulnerability that exposes email configurations, stored credentials, and mail server data to…

How to fix or mitigate CVE-2026-29963?

Within 24 hours: Identify all systems running HSC MailInspector 5.3.3-7 or earlier and verify their network exposure. Within 7 days: Restrict access to the /tap/dw.php endpoint via firewall rules; deploy WAF rules to block path traversal patterns in the 'text' parameter; enable detailed logging on file access attempts. Within 30 days: Contact HSC vendor for patched version availability and timeline; if no patch is released, evaluate alternative email security solutions or implement compensating controls as interim measures.

HSC MailInspector CVE-2026-29963

EUVD-2026-30783 HIGH

Path Traversal (CWE-22)

2026-05-18 mitre

GHSA-wcm2-h52j-8wcv

PHP Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 15:22 vuln.today

CVSS changed

May 19, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

May 18, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.

AnalysisAI

Unauthenticated path traversal in HSC MailInspector 5.3.3-7 allows remote attackers to read arbitrary files from the underlying operating system by manipulating the 'text' parameter of the /tap/dw.php endpoint. Public exploit details are disclosed on GitHub (sql3t0/cve-disclosures), though EPSS probability remains low (0.05%) and the issue is not currently listed in CISA KEV. The flaw enables disclosure of sensitive system files such as configuration files, credentials, and mail-related data without prior authentication.

Technical ContextAI

HSC MailInspector is a PHP-based email security and content-inspection gateway developed by HSC Brasil. The vulnerable component is the /tap/dw.php endpoint, which appears to function as a file download/handler script. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the 'text' parameter is concatenated into a filesystem path without canonicalization or restriction to a designated base directory, allowing sequences such as '../' to traverse outside the intended directory. Because the application runs on PHP, an attacker can target standard Linux/Unix paths (e.g., /etc/passwd, application config files containing database credentials, or stored email metadata) reachable by the web server's user account. The provided CPE string is non-normative ('cpe:2.3:a:n/a:n/a:*'), so precise affected-product enumeration relies on the vendor description rather than NVD CPE matching.

RemediationAI

No vendor-released patch identified at time of analysis - defenders should contact HSC (hsclabs.com) directly for a fixed build of MailInspector beyond 5.3.3-7 and monitor the vendor page at https://hsclabs.com/pt-br/mailinspector/ for advisories. In the interim, the most effective compensating control is to block external access to the /tap/dw.php endpoint at the reverse proxy or WAF (e.g., deny requests where the 'text' parameter contains '../', URL-encoded traversal sequences like '%2e%2e%2f', or absolute paths beginning with '/'), accepting the side effect that any legitimate download functionality served by that endpoint will break. Restricting MailInspector's web interface to a management VLAN or VPN drastically reduces exposure with the trade-off of inconvenience for remote administrators, and running the PHP-FPM/web-server process under a minimally privileged account with open_basedir restrictions in php.ini will limit which files an attacker can read even if the traversal succeeds. Public technical details are available at https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md and should be reviewed to tune WAF signatures.