CVE-2026-67447

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.

In Mailpit before version 1.30.4, the GET /api/v1/message/{id}/part/{partID}/thumb endpoint decodes image attachments into a full raster before checking dimensions, pixel count, or memory use. A compact image with very large dimensions can consume disproportionately large memory and CPU, potentially leading to service availability degradation.

In Mailpit before version 1.30.4, the SMTP command reader allocates the full command line before enforcing the 512-octet limit. An unauthenticated remote SMTP client can send an oversized single command line, which can lead to excessive memory consumption and reduced service availability.

Mailpit before version 1.30.1 has a DoS vulnerability in four JSON API endpoints with no body size limit, allowing an unauthenticated remote attacker to cause significant memory consumption.

Mailpit before version 1.30.0 does not limit the size of data sent via SMTP or HTTP, allowing an attacker to send very large messages. This causes a spike in RAM consumption (up to 7-10x amplification), potentially leading to an OOM kill.

Mailpit prior to version 1.30.0 has a vulnerability in the screenshot/print proxy (/proxy?data=…) where an unsynchronized map read during concurrent writes causes a fatal Go error (concurrent map read and map write), crashing the entire Mailpit process.

Path traversal vulnerability in Mailpit before version 1.30.0. The message ID field is taken verbatim from the JSON response and concatenated into the output path with path.Join, which normalizes '..' segments. A malicious server impersonating Mailpit can write attacker-controlled bytes to any path the running user can write.

Mailpit contains an SSRF vulnerability in the HTML check component that allows access to internal network resources. Despite previous fixes, the CSS download mechanism does not filter IP addresses, enabling an attacker to redirect requests to private IPs. The vulnerability is unauthenticated in the default configuration.

Mailpit prior to version 1.30.2 has an incomplete fix for CVE-2026-27808 that fails to block all IPv6 transition mechanisms (NAT64, 6to4, ISATAP, etc.). An attacker can use the Link Check API to scan internal services, including cloud metadata endpoints.