CVE-2026-29963 is a path traversal vulnerability in HSC MailInspector 5.3.3-7. The issue exists because the /tap/dw.php endpoint uses the user-supplied 'text' parameter to construct file paths without proper validation or normalization. This allows an unauthenticated remote attacker to access arbitrary files on the underlying operating system, leading to unauthorized disclosure of sensitive data. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 7.5 (High), with attack vector network, low attack complexity, no privileges required, no user interaction, and impact on confidentiality only.

Successful exploitation enables remote attackers to read arbitrary files on the affected system without authentication. This can lead to unauthorized disclosure of sensitive information stored on the server. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to file access attempts. Avoid exposing the /tap/dw.php endpoint to untrusted networks. Follow up with the vendor for updates on patch availability.