CVE-2026-23620
Received Received - Intake

Arbitrary File Existence Enumeration in GFI MailEssentials AI

Publication date: 2026-02-19

Last updated on: 2026-02-20

Assigner: VulnCheck

Description
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to File.Exists(), allowing the attacker to determine whether arbitrary files exist on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-20
Generated
2026-07-06
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-05
NVD
CVE-2026-23620
EUVD
EUVD-2026-7812

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gfi mailessentials to 22.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in GFI MailEssentials AI versions prior to 22.4 and involves an arbitrary file existence enumeration issue in the ListServer.IsDBExist() web method.

An authenticated user can supply an unrestricted filesystem path through the JSON key "path". This input is URL-decoded and passed to the File.Exists() function, which allows the attacker to determine whether arbitrary files exist on the server.

Impact Analysis

The vulnerability allows an authenticated attacker to enumerate files on the server by checking for their existence.

This can lead to information disclosure, as the attacker can gain knowledge about the server's filesystem structure and potentially sensitive files.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart