Mailpit
Monthly
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits, due to a percent-encoding bypass in the origin-check middleware. The origin guard inspects the raw `RequestURI` for an `/api/` prefix, but Go's `ServeMux` routes on the percent-decoded path - so a request to `/%61pi/events` skips the guard and reaches the `/api/events` WebSocket handler, whose upgrader unconditionally accepts every origin. An attacker-controlled page can receive a live stream of message IDs, headers, subjects, and body snippets from a default, unauthenticated Mailpit instance; a working proof of concept is documented in GHSA-8r62-w5wh-fc5m, though no CISA KEV listing exists at time of analysis.
Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients to force heap allocation beyond the configured MaxMessageSize limit by transmitting a single DATA line exceeding the cap - because `bufio.Reader.ReadBytes('\n')` buffers the entire line into memory before the size check is applied. This is a post-fix incomplete remediation of an earlier SMTP body-size advisory: multi-line DATA accumulation was bounded, but single-line pre-read was not, leaving a residual gap in versions 1.30.0-1.30.4. A proof-of-concept demonstrating a 64 MiB single-line RSS spike is included in the GitHub security advisory; no active exploitation has been confirmed (not listed in CISA KEV).
Mailpit versions prior to 1.29.2 contain a Server-Side Request Forgery vulnerability in the Link Check API that allows unauthenticated remote attackers to perform HTTP requests to arbitrary hosts, including internal and private IP addresses. The API fails to validate or filter target URLs and returns status codes for each link, enabling non-blind SSRF attacks. Public exploit code exists for this vulnerability, affecting deployments with default configuration.
Mailpit versions before 1.28.3 contain a server-side request forgery vulnerability in the HTML Check feature that allows unauthenticated attackers to trigger arbitrary HTTP requests by crafting malicious CSS links in email messages. The vulnerability exists in the CSS inlining function which automatically downloads external stylesheets without proper validation. Public exploit code exists for this issue, though a patch is available in version 1.28.3 and later.
Header injection in Mailpit's SMTP server prior to version 1.28.3 allows unauthenticated remote attackers to inject or modify email headers by embedding carriage return characters in sender and recipient addresses due to insufficient regex validation. Public exploit code exists for this vulnerability, which could enable attackers to manipulate email routing, spoofing, or phishing attacks against users of the email testing tool. The issue is resolved in version 1.28.3 and later.
Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email contents, headers, and server statistics (CVSS 6.5).
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that permits unauthenticated attackers to probe and access internal network resources and services. The endpoint insufficiently validates destination addresses, allowing requests to internal IP ranges despite scheme validation. Public exploit code exists for this vulnerability, which is resolved in version 1.28.1.
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits, due to a percent-encoding bypass in the origin-check middleware. The origin guard inspects the raw `RequestURI` for an `/api/` prefix, but Go's `ServeMux` routes on the percent-decoded path - so a request to `/%61pi/events` skips the guard and reaches the `/api/events` WebSocket handler, whose upgrader unconditionally accepts every origin. An attacker-controlled page can receive a live stream of message IDs, headers, subjects, and body snippets from a default, unauthenticated Mailpit instance; a working proof of concept is documented in GHSA-8r62-w5wh-fc5m, though no CISA KEV listing exists at time of analysis.
Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients to force heap allocation beyond the configured MaxMessageSize limit by transmitting a single DATA line exceeding the cap - because `bufio.Reader.ReadBytes('\n')` buffers the entire line into memory before the size check is applied. This is a post-fix incomplete remediation of an earlier SMTP body-size advisory: multi-line DATA accumulation was bounded, but single-line pre-read was not, leaving a residual gap in versions 1.30.0-1.30.4. A proof-of-concept demonstrating a 64 MiB single-line RSS spike is included in the GitHub security advisory; no active exploitation has been confirmed (not listed in CISA KEV).
Mailpit versions prior to 1.29.2 contain a Server-Side Request Forgery vulnerability in the Link Check API that allows unauthenticated remote attackers to perform HTTP requests to arbitrary hosts, including internal and private IP addresses. The API fails to validate or filter target URLs and returns status codes for each link, enabling non-blind SSRF attacks. Public exploit code exists for this vulnerability, affecting deployments with default configuration.
Mailpit versions before 1.28.3 contain a server-side request forgery vulnerability in the HTML Check feature that allows unauthenticated attackers to trigger arbitrary HTTP requests by crafting malicious CSS links in email messages. The vulnerability exists in the CSS inlining function which automatically downloads external stylesheets without proper validation. Public exploit code exists for this issue, though a patch is available in version 1.28.3 and later.
Header injection in Mailpit's SMTP server prior to version 1.28.3 allows unauthenticated remote attackers to inject or modify email headers by embedding carriage return characters in sender and recipient addresses due to insufficient regex validation. Public exploit code exists for this vulnerability, which could enable attackers to manipulate email routing, spoofing, or phishing attacks against users of the email testing tool. The issue is resolved in version 1.28.3 and later.
Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email contents, headers, and server statistics (CVSS 6.5).
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that permits unauthenticated attackers to probe and access internal network resources and services. The endpoint insufficiently validates destination addresses, allowing requests to internal IP ranges despite scheme validation. Public exploit code exists for this vulnerability, which is resolved in version 1.28.1.