PT-2026-3488 · Mailpit · Mailpit

Mdisec · Published 2026-01-19 · Updated 2026-02-26 · CVE-2026-23845

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.28.3

Description Mailpit, an email testing tool and API for developers, contains a Server-Side Request Forgery (SSRF) issue. This flaw is related to the HTML Check CSS Download functionality, specifically within the HTML Check feature accessible via the /api/v1/message/{ID}/html-check API endpoint. The inlineRemoteCSS() function automatically downloads CSS files from external sources specified in <link rel="stylesheet" href="..."> tags during HTML analysis. This process can be exploited to trigger requests to unintended locations.

Recommendations Update to Mailpit version 1.28.3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-23845

GHSA-6JXM-FV7W-RW5J

GO-2026-4345

SUSE-SU-2026:0403-1

Affected Products

Mailpit

References · 90

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23845.json · Exploit
• https://github.com/axllent/mailpit/commit/1679a0aba592ebc8487a996d37fea8318c984dfe · Patch
• https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jxm-fv7w-rw5j · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23845 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23845 · Vendor Advisory
• https://github.com/axllent/mailpit · Note
• https://github.com/axllent/mailpit/releases/tag/v1.28.3 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-24058 · Note
• https://suse.com/security/cve/CVE-2025-67601 · Note
• https://twitter.com/VulmonFeeds/status/2013434380618727435 · Twitter Post