CVE-2026-29963
published 2026-05-18CVE-2026-29963: HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter…
PriorityP353high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.60%
44.0th percentile
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hsclabs | mailinspector | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HSC Mailinspector 5.3.3-7 Normalization /tap/dw.php text path traversal
vuldb·2026-05-18
CVE-2026-29963 [CRITICAL] HSC Mailinspector 5.3.3-7 Normalization /tap/dw.php text path traversal
A vulnerability labeled as critical has been found in HSC Mailinspector 5.3.3-7. Affected by this issue is some unknown functionality of the file /tap/dw.php of the component Normalization Handler. Executing a manipulation of the argument text can lead to path traversal.
This vulnerability is handled as CVE-2026-29963. The attack can be executed remotely. There is not any exploit available.
GHSA
GHSA-wcm2-h52j-8wcv: HSC MailInspector 5
ghsa_unreviewed·2026-05-18
CVE-2026-29963 [HIGH] CWE-22 GHSA-wcm2-h52j-8wcv: HSC MailInspector 5
HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory. A remote attacker can exploit this flaw to access arbitrary files on the underlying operating system, resulting in unauthorized disclosure of sensitive information.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-18
Published