The vulnerability in HSC MailInspector v5.3.3-7 is a Local File Inclusion (LFI) issue caused by improper control of user-supplied file paths in the /vendor/phpunit/phpunit.php endpoint. User-controlled parameters directly influence file access operations without adequate validation or path restriction, enabling attackers to use path traversal techniques to read arbitrary files from the operating system and application directories. This can result in sensitive information disclosure. The vulnerability is publicly documented as CVE-2026-29962 but lacks a CVSS score and official remediation details.

Successful exploitation allows remote attackers to read arbitrary files on the affected system, potentially exposing sensitive data stored in the operating system or application directories. This could compromise confidentiality but does not indicate direct code execution or system takeover based on the available information. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider disabling or removing the /vendor/phpunit/phpunit.php component if not required. Monitor for vendor updates regarding patches or mitigations.