A critical Local File Inclusion and path traversal vulnerability in HSC MailInspector v5 may allow unauthenticated attackers to read arbitrary files from the underlying system.

The application is susceptible to Local File Inclusion (LFI) and path traversal due to improper input validation, allowing an unauthenticated remote attacker to access sensitive local files.

Successful exploitation allows an attacker to bypass directory restrictions and read sensitive configuration files or system data. Given the CVSS score of 7.5, this vulnerability represents a high risk to data confidentiality and could facilitate further system compromise or credential theft.

Immediate Action: Review the vendor's security disclosures and apply available patches or configuration changes provided by HSC.

Proactive Monitoring: Monitor server access logs for anomalous directory traversal patterns, such as sequences like "../" or access requests to sensitive system files (e.g., /etc/passwd).

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests containing path traversal sequences directed at the application.

Public Exploit Available: Yes — a public proof-of-concept is available via the researcher's disclosure repository on GitHub.

This vulnerability poses a significant risk due to its unauthenticated nature and the availability of public exploit material. Administrators should prioritize identifying instances of MailInspector v5 and applying vendor-recommended mitigations immediately to prevent unauthorized data exfiltration.