CVE-2026-29962: Hsclabs Mailinspector Path Traversal Flaw

CVE-2026-29962 Overview

CVE-2026-29962 is a Local File Inclusion (LFI) vulnerability affecting HSC MailInspector version 5.3.3-7. The flaw exists in the /vendor/phpunit/phpunit.php endpoint, which processes user-supplied parameters that influence file access operations without proper validation or path restriction. A remote, unauthenticated attacker can leverage path traversal sequences to read arbitrary files from the underlying operating system and application directories. Successful exploitation discloses sensitive information including configuration files, credentials, and source code. The vulnerability is categorized under CWE-73: External Control of File Name or Path.

Critical Impact

Remote unauthenticated attackers can read arbitrary files on systems running HSC MailInspector 5.3.3-7, exposing credentials, configuration data, and other sensitive content.

Affected Products

• HSC MailInspector 5.3.3-7
• Vendor: HSC Labs (hsclabs)
• Vulnerable endpoint: /vendor/phpunit/phpunit.php

Discovery Timeline

• 2026-05-18 - CVE-2026-29962 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-29962

Vulnerability Analysis

The vulnerability resides in the /vendor/phpunit/phpunit.php endpoint exposed by HSC MailInspector 5.3.3-7. This script accepts user-controlled parameters that are passed directly to file access operations. The application fails to validate, sanitize, or restrict the resulting file paths. As a result, an attacker can inject relative path traversal sequences such as ../ to escape the intended directory and reference files anywhere on the file system. The issue maps to CWE-73: External Control of File Name or Path, which describes flaws where untrusted input governs file or directory selection.

Root Cause

The root cause is the public exposure of a PHPUnit testing artifact (phpunit.php) inside the vendor directory of a production deployment. PHPUnit is a development-time dependency and should never be reachable over the network. Combined with the absence of input validation on file path parameters, the script becomes a direct primitive for arbitrary file reads. The component performs no canonicalization, no allow-list checking, and no enforcement of a base directory boundary.

Attack Vector

Exploitation requires only network access to the MailInspector web interface. No authentication, user interaction, or elevated privileges are needed. An attacker submits a crafted HTTP request to the vulnerable endpoint with a path traversal payload in the affected parameter. The server resolves the traversal and returns the contents of the targeted file, which can include /etc/passwd, application configuration files, database credentials, mail spool data, and TLS private keys. Refer to the CVE-2026-29962 Analysis for additional technical detail.

Detection Methods for CVE-2026-29962

Indicators of Compromise

• HTTP requests to /vendor/phpunit/phpunit.php containing ../ sequences, URL-encoded variants (%2e%2e%2f), or absolute paths such as /etc/passwd.
• Web server access logs showing repeated 200 responses to phpunit.php from external IP addresses.
• Outbound exfiltration of files immediately following requests to the vulnerable endpoint.
• Any request reaching files under /vendor/ from untrusted sources, since vendor directories should not be web-accessible.

Detection Strategies

• Deploy web application firewall (WAF) signatures that flag path traversal patterns directed at MailInspector endpoints.
• Inspect application and reverse proxy logs for requests targeting phpunit.php or other PHPUnit development scripts.
• Correlate file read anomalies on the host with concurrent HTTP traffic to MailInspector.

Monitoring Recommendations

• Alert on any HTTP request matching /vendor/phpunit/ regardless of parameter content.
• Monitor read access on sensitive files such as /etc/passwd, /etc/shadow, and application configuration paths from the web server process.
• Forward MailInspector and web server logs to a centralized SIEM for retention and correlation against threat intelligence.

How to Mitigate CVE-2026-29962

Immediate Actions Required

• Block external access to /vendor/ and /vendor/phpunit/phpunit.php at the reverse proxy or web server level.
• Restrict MailInspector administrative interfaces to trusted management networks only.
• Audit web server logs for prior exploitation attempts and rotate any credentials or secrets that may have been disclosed.

Patch Information

No vendor advisory or patch URL is listed in the available CVE references. Consult the HSC Labs Mail Inspector Overview and contact the vendor directly for fixed releases. Track the GitHub CVE Disclosures Repository for updates on the disclosure.

Workarounds

• Configure the web server to deny all requests to paths beginning with /vendor/.
• Remove PHPUnit and other development dependencies from production deployments using composer install --no-dev.
• Run the MailInspector application under a least-privilege account that cannot read sensitive system files outside the application directory.
• Place the application behind a WAF with path traversal protection enabled.

# Configuration example: Nginx deny rule blocking access to vendor directory
location ~* /vendor/ {
    deny all;
    return 403;
}

location ~* /vendor/phpunit/.*\.php$ {
    deny all;
    return 403;
}