Which products and versions are affected by CVE-2026-29962?

Affected: Mailinspector (Hsclabs) versions 5.3.3-7. The full list is in the CVE brief.

Is CVE-2026-29962 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2026-29962 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2026-29962?

No public exploit code is known.

Is there a fix for CVE-2026-29962?

No fixed version is listed yet; check the vendor advisory for mitigations.

How urgently should CVE-2026-29962 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2026-29962

High

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths.

Published May 18, 2026 · Updated May 19, 2026

Key Facts

Patch in the next maintenance window

CVE-2026-29962 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Mailinspector (Hsclabs).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 1.8% probability of exploitation in the next 30 days.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

1.8%

Higher than 78.6% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2026-29962 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters that directly affect file access operations without adequate validation, sanitization, or path restriction. This allows a remote attacker to exploit Path Traversal techniques to read arbitrary files from the underlying operating system and application directories, leading to sensitive information disclosure.

Affected Products

1 affected entries in total

Product	Affected versions	Fixed in
MailinspectorHsclabs	5.3.3-7	n/a

Timeline

Publicly disclosed
May 18, 2026
Last updated
May 19, 2026

Weakness Type

CWE-73 External Control of File Name or Path

References

FAQ

Common Questions.

HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths.
Affected: Mailinspector (Hsclabs) versions 5.3.3-7. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2026-29962 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.