CVE-2026-23620: GFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to File.Exists(), allowing the attacker to determine whether arbitrary files exist on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23620?
CVE-2026-23620 is classified as a medium severity vulnerability due to its arbitrary file existence enumeration capabilities.
How can I fix CVE-2026-23620?
To fix CVE-2026-23620, upgrade GFI MailEssentials AI to version 22.4 or later, which addresses this vulnerability.
Who is affected by CVE-2026-23620?
CVE-2026-23620 affects all versions of GFI MailEssentials AI prior to 22.4.
What type of vulnerability is CVE-2026-23620?
CVE-2026-23620 is an arbitrary file existence enumeration vulnerability that impacts the ListServer.IsDBExist() web method.
What impact does CVE-2026-23620 have?
The CVE-2026-23620 vulnerability allows authenticated users to potentially exploit the system by enumerating files on the server.