CVE-2026-23621
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Feb 19, 2026
CISA due date
—
The record
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
- CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87566 Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87516 Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87518 Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36… CWE-203