CVE-2026-23621

GFI MailEssentials AI versions prior to 22.4 contain an authentication-restricted directory existence enumeration vulnerability in ListServer.IsPathExist() (exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist). An authenticated user can supply an unrestricted filesystem path...