An authenticated user can supply an unrestricted, URL‑decoded filesystem path through the JSON "path" key of the ListServer.IsDBExist web method, causing ServerSide code to call File.Exists and return the existence status of any target file. This flaw allows the attacker to enumerate arbitrary files on the MailEssentials AI server, revealing sensitive file locations and potentially facilitating subsequent attacks such as credential theft or code execution through other vulnerabilities. The weakness is a classic input validation flaw (CWE-203) that directly leads to disclosure of internal system information.

The vulnerability affects GFI Software MailEssentials AI versions prior to 22.4, specifically the ListServer.IsDBExist endpoint located at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. Users with valid authentication against the application can exploit the flaw; no unauthenticated access is required.

The CVSS score is 5.3, indicating medium severity, while the EPSS score is below 1%, reflecting a very low exploitation probability as of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to obtain valid credentials and craft a request to the vulnerable endpoint, then supply arbitrary paths. The practical impact is limited to knowledge of file existence, but it can be a stepping stone toward more serious attacks when combined with other weaknesses.