Mailpit
CVE-2026-23845
MEDIUM
GHSA-6jxm-fv7w-rw5j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (/api/v1/message/{ID}/html-check) is designed to analyze HTML emails for compatibility. During this process, the inlineRemoteCSS() function automatically downloads CSS files from external <link rel="stylesheet" href="..."> tags to inline them for testing. Version 1.28.3 fixes the issue.
AnalysisAI
Mailpit versions before 1.28.3 contain a server-side request forgery vulnerability in the HTML Check feature that allows unauthenticated attackers to trigger arbitrary HTTP requests by crafting malicious CSS links in email messages. The vulnerability exists in the CSS inlining function which automatically downloads external stylesheets without proper validation. Public exploit code exists for this issue, though a patch is available in version 1.28.3 and later.
Technical ContextAI
Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Mailpit. Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (/api/v1/message/{ID}/html-check) is designed to analyze HTML emails for compatibility. During this process, the inlineRemoteCSS() function automatically downloads CSS files from external <link rel="stylesheet" href="..."> tags to inline them for testing. Version 1.28.3 fixes the issue.
RemediationAI
A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.
Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email c
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that perm
Mailpit versions prior to 1.29.2 contain a Server-Side Request Forgery vulnerability in the Link Check API that allows u
Header injection in Mailpit's SMTP server prior to version 1.28.3 allows unauthenticated remote attackers to inject or m
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits,
Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today