CVE-2026-23620
Arbitrary File Existence Enumeration in GFI MailEssentials AI
Publication date: 2026-02-19
Last updated on: 2026-02-20
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gfi | mailessentials | to 22.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-203 | The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in GFI MailEssentials AI versions prior to 22.4 and involves an arbitrary file existence enumeration issue in the ListServer.IsDBExist() web method.
An authenticated user can supply an unrestricted filesystem path through the JSON key "path". This input is URL-decoded and passed to the File.Exists() function, which allows the attacker to determine whether arbitrary files exist on the server.
How can this vulnerability impact me? :
The vulnerability allows an authenticated attacker to enumerate files on the server by checking for their existence.
This can lead to information disclosure, as the attacker can gain knowledge about the server's filesystem structure and potentially sensitive files.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know