A critical LFI and path traversal vulnerability in HSC MailInspector 5 allows unauthenticated attackers to read arbitrary files from the server.

The vulnerability involves Local File Inclusion (LFI) and path traversal, allowing an unauthenticated attacker (AV:N/AC:L/PR:N) to bypass directory restrictions and access sensitive files on the underlying file system.

An LFI vulnerability allows attackers to read configuration files, application source code, or sensitive system files, potentially leading to full system compromise. With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and confidentiality of the host server.

Immediate Action: Contact the vendor (HSC) immediately for security updates and verify if your specific version is vulnerable.

Proactive Monitoring: Monitor file system access logs for suspicious traversal patterns (e.g., ../../) and unauthorized attempts to access system-level files.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to detect and block path traversal and LFI payloads.

Public Exploit Available: Yes — a public proof-of-concept is available via the researcher's GitHub repository.

This vulnerability is highly dangerous due to the existence of public exploit code. Administrators must treat this as an urgent issue and immediately implement WAF protections while awaiting a formal patch from the vendor.