Summary
Ein Angreifer kann mehrere Schwachstellen in MailPit ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.
Product
Mailpit ist ein Open-Source-E-Mail-Testwerkzeug, das als lokaler SMTP-Server zum Auffangen und Anzeigen von E-Mails dient, ohne diese tatsächlich zu versenden.
Vulnerabilities 2
-
Medium 5.8
Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails f…
-
Medium 5.3
Mailpit has SMTP Header Injection via Regex Bypass
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject ar…
Revision history
-
#2
Neue Updates von SUSE aufgenommen
-
#1
Initiale Fassung
References
-
NIST Vulnerability Database vom 2026-01-19
https://nvd.nist.gov/vuln/detail/CVE-2026-23829
-
NIST Vulnerability Database vom 2026-01-19
https://nvd.nist.gov/vuln/detail/CVE-2026-23845
-
Mailpit GitHub vom 2026-01-19
https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c
-
Mailpit GitHub vom 2026-01-19
https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j
-
SUSE Security Update SUSE-SU-2026:0403-1 vom 2026-02-09
https://lists.suse.com/pipermail/sle-security-updates/2026-February/024084.html