CVE-2026-23621: GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23621?
CVE-2026-23621 is classified as a medium severity vulnerability due to its potential for directory enumeration by authenticated users.
How do I fix CVE-2026-23621?
To fix CVE-2026-23621, you should update GFI MailEssentials AI to version 22.4 or later, which contains the necessary security patches.
Who is affected by CVE-2026-23621?
CVE-2026-23621 affects all versions of GFI MailEssentials AI prior to 22.4.
What type of vulnerability is CVE-2026-23621?
CVE-2026-23621 is an arbitrary directory existence enumeration vulnerability found in the ListServer.IsPathExist() web method.
What can an attacker do with CVE-2026-23621?
An attacker with authenticated access can exploit CVE-2026-23621 to enumerate filesystem paths, potentially exposing sensitive information.