CVE-2026-45709
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Mailpit contains an SSRF vulnerability in the HTML check component that allows access to internal network resources. Despite previous fixes, the CSS download mechanism does not filter IP addresses, enabling an attacker to redirect requests to private IPs. The vulnerability is unauthenticated in the default configuration.
Risk Assessment
An attacker can exploit this vulnerability to scan internal networks, access services running on localhost or private networks, potentially leading to privilege escalation or data exfiltration.
Recommendation
Upgrade Mailpit to version 1.30.0 or later immediately. As a workaround, enable the --block-remote-css-and-fonts flag and restrict API access to trusted networks.
Other vulnerabilities in Mailpit
See all- CVE-2026-67448Medium
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.
- CVE-2026-67447Medium
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calls bufio.Reader.ReadBytes before applying the len(data)+len(line) size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client can send a single line larger than the configured MaxMessageSize, causing the full line to be allocated before Mailpit returns the 552 5.3.4 rejection. This post-fix gap remains after normal multi-line DATA accumulation was bounded, and concurrent oversized lines can create substantial memory pressure beyond the configured message-size cap. This issue is fixed in version 1.30.5.
- CVE-2026-67446Medium
In Mailpit before version 1.30.4, the GET /api/v1/message/{id}/part/{partID}/thumb endpoint decodes image attachments into a full raster before checking dimensions, pixel count, or memory use. A compact image with very large dimensions can consume disproportionately large memory and CPU, potentially leading to service availability degradation.
- CVE-2026-67445Medium
In Mailpit before version 1.30.4, the SMTP command reader allocates the full command line before enforcing the 512-octet limit. An unauthenticated remote SMTP client can send an oversized single command line, which can lead to excessive memory consumption and reduced service availability.
- CVE-2026-48824Medium
Mailpit before version 1.30.1 has a DoS vulnerability in four JSON API endpoints with no body size limit, allowing an unauthenticated remote attacker to cause significant memory consumption.
- CVE-2026-45713High
Mailpit before version 1.30.0 does not limit the size of data sent via SMTP or HTTP, allowing an attacker to send very large messages. This causes a spike in RAM consumption (up to 7-10x amplification), potentially leading to an OOM kill.
- CVE-2026-45712Medium
Mailpit prior to version 1.30.0 has a vulnerability in the screenshot/print proxy (/proxy?data=…) where an unsynchronized map read during concurrent writes causes a fatal Go error (concurrent map read and map write), crashing the entire Mailpit process.
- CVE-2026-45711Medium
Path traversal vulnerability in Mailpit before version 1.30.0. The message ID field is taken verbatim from the JSON response and concatenated into the output path with path.Join, which normalizes '..' segments. A malicious server impersonating Mailpit can write attacker-controlled bytes to any path the running user can write.
- CVE-2026-55187Medium
Mailpit prior to version 1.30.2 has an incomplete fix for CVE-2026-27808 that fails to block all IPv6 transition mechanisms (NAT64, 6to4, ISATAP, etc.). An attacker can use the Link Check API to scan internal services, including cloud metadata endpoints.
Original NVD description (English source)
Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text/css` content-type check, login-info stripping in `isValidURL`, and an opt-in `--block-remote-css-and-fonts` config flag — but did not add the IP-filtering dialer that the same codebase already uses on the two sister SSRF endpoints (the proxy handler and link-check). Prior to version 1.30.0, `internal/htmlcheck/css.go::newSafeHTTPClient` is mis-named — it builds an `http.Client` whose `Transport.DialContext` calls `net.Dialer.DialContext` directly with no IP allowlisting. As a result, the SSRF originally reported by Bao Anh Phan still permits the server to dial loopback, private, link-local, and any other reserved/multicast range, provided the target replies with `HTTP/200` and a content-type beginning with `text/css`. With redirect-following (`CheckRedirect` allows redirects to any `isValidURL` URL with no IP filter), an attacker-controlled public site can redirect mailpit's request into the private network without ever appearing in the email's HTML. In the default mailpit deploy (no UI auth, no SMTP auth, port 1025/8025 exposed), this is an unauthenticated, network-reachable SSRF triggered by sending an HTML email and then issuing one HTTP `GET` to `/api/v1/message/{id}/html-check`. Version 1.30.0 contains an updated fix.