🛡️ CVE-2026-29962 — mailinspector
Description
HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure.
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity none, availability none.
Weakness class
CVE-2026-29962 is classified as CWE-73: External Control of File Name or Path. A caller can influence which file the application opens or writes, extending an operation to files that were never meant to be reachable.
Affected software
CVE-2026-29962 is recorded against 2 packages.
- mailinspector
- unknown
Timeline and source
Published on 18 May 2026 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.
References
Details
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| mailinspector | — | — |
| unknown | — | — |
References
Similar Threats
- High CVE-2026-29963
- Medium CVE-2026-29964
- Medium CVE-2026-29965
- Medium CVE-2024-32369
- Critical CVE-2024-32370
Site Security Check
Is mailinspector part of your stack?
CVE-2026-29962 is rated CVSS 7.5 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.