The vulnerability is a local file inclusion flaw that occurs when user-supplied file paths are passed to an endpoint without proper validation, sanitization, or path restriction. In the affected HSC MailInspector v5.3.3-7, the /vendor/phpunit/phpunit.php route accepts parameters that influence file access operations. Because the input is not restricted, an attacker can craft a request that traverses directories and reads arbitrary files on the underlying operating system and application directories, exposing confidential data such as configuration files, credentials, or logs.

The flaw resides specifically in HSC MailInspector version 5.3.3-7. Any installation of that version, as utilized in environments that expose the /vendor/phpunit/phpunit.php endpoint to remote users, is susceptible to exploitation. No other versions or products are known to share this issue at the time of this analysis.

Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, an LFI vulnerability that permits arbitrary file reads is severe and easy to exploit over the network. A remote attacker can trigger the flaw by sending a specially crafted HTTP request to the vulnerable endpoint, without needing privileged credentials. The lack of exploitation evidence suggests the risk may currently be moderate to high, but the potential for data disclosure warrants prompt remediation.