Medium severity · published Feb 19, 2026
CVE-2026-23621
GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MailEssentials AI · GFI Software
before 22.4 · source: vendor
MA
Mailessentials · Gfi
before 22.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23621
Release Notes
https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases
Third Party Advisory
https://www.vulncheck.com/advisories/gfi-mailessentials-ai-listserver-ispathexist-absolute-directory-traversal-to-file-enumeration
More from MailEssentials AI
5.4
CVE-2026-23619
GFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSS
5.4
CVE-2026-23618
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS
5.4
CVE-2026-23617
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS
5.4
CVE-2026-23616
GFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSS
5.4
CVE-2026-23615
GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSS