CVE-2026-29962

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan External Control of File Name or Path pada hsclabs mailinspector. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sql3t0/cve-disclosures advisory pihak ketiga
• https://github.com/sql3t0/cve-disclosures/blob/main/01_-_CVE-2026-29962_LFI%2BPath_Traversal.md advisory pihak ketiga
• https://hsclabs.com/pt-br/mailinspector product