CVE-2026-23621
Received Received - Intake

Directory Enumeration Vulnerability in GFI MailEssentials AI Web Method

Publication date: 2026-02-19

Last updated on: 2026-02-20

Assigner: VulnCheck

Description
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-19
Last Modified
2026-02-20
Generated
2026-07-06
AI Q&A
2026-02-19
EPSS Evaluated
2026-07-05
NVD
CVE-2026-23621
EUVD
EUVD-2026-8317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gfi mailessentials to 22.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in GFI MailEssentials AI versions prior to 22.4. It is an arbitrary directory existence enumeration issue found in the ListServer.IsPathExist() web method, which is accessible at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist.

An authenticated user can provide any filesystem path through the JSON key "path". This input is URL-decoded and then passed to the Directory.Exists() function, which allows the attacker to check if arbitrary directories exist on the server.

Impact Analysis

This vulnerability allows an authenticated attacker to enumerate directories on the server's filesystem. By determining the existence of directories, an attacker can gather information about the server's file structure, which may aid in further attacks or exploitation.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart