The vulnerability exists in the ListServer.IsPathExist() web method for GFI MailEssentials AI prior to version 22.4. An authenticated user can submit any file system path via the JSON key "path", which is URL-decoded and passed to Directory.Exists(). This allows the attacker to determine whether arbitrary directories exist on the server, exposing directory structure information. The flaw is identified as CWE-203, an arbitrary information disclosure weakness.

All installations of GFI Software MailEssentials AI with a version earlier than 22.4 are affected. This includes any deployment where the ListServer.IsPathExist web service is available and reachable by authenticated users.

The CVSS score is 5.3, indicating moderate severity. EPSS is below 1%, implying a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Because the endpoint requires authentication, exploitation requires valid user credentials or a compromised account, but once authenticated the attacker can freely enumerate directory existence, potentially aiding further attacks.