215 matches found
Mailpit < 1.28.3 - Server-Side Request Forgery
Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...
-CVE-2026-23829-CTT-Mailpit-phase-reconstruction-
SimoesCTT-mailpit-phase-reconstructor これはMailpitのSMTPサーバーにおけるCRLFインジェクション — 古典的なデータ破損の脆弱性です。しかしCTTの観点では、これは単なるバグではありません。位相再構築の機会なのです。 CVE-2026-23829 root@kitploit: CTT-Mailpit-Phase-Reconstructor CVE-2026-23829 — 新物理の証明 --- ⚡ TL;DR...
CTT-Mailpit-RCE-v1.0---Temporal-Resonance-Mail-Server-Takeover
🎯 CTT-Mailpit-Exploit: 완벽한 11/10 점수 제로클릭 웜 기본 SMTP 헤더 인젝션CVE-2026-23829을 수렴 시간 이론Convergent Time Theory을 사용하여 완벽한 점수의 자가 증식 RCE 웜으로 변환합니다. 📊 점수 변환: 6.1 → 11.0/10 ⭐...
CVE-2026-67446
creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:04+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-75mr-qw9x-3r39 2026-09-03 07:31:59+00:00| seen| https://gist.github.com/alon710/3dcd56ab41cf2fc234bc88855814c85c...
CVE-2026-67445
creationtimestamp| type| source ---|---|--- 2026-09-03 00:35:02+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-w878-pj84-3j5v 2026-09-03 05:32:21+00:00| seen| https://gist.github.com/alon710/25d950fb1b775a5961200e6e2792284d...
EUVD-2026-63663
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...
GHSA-W878-PJ84-3J5V Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...
GHSA-75MR-QW9X-3R39 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
Summary Mailpit's thumbnail endpoint decodes attacker-supplied image attachments into a full raster before checking any decoded-pixel, dimension, or memory budget. A remote client that can store an email and reach the default web API can supply a compact high-dimension image, then request...
EUVD-2026-63659
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling...
CVE-2026-84697
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...
CVE-2026-84697 Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...
EUVD-2026-69788
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...
CVE-2026-84697
Mailpit (open-source mail testing tool) contains a Server-Side Request Forgery (SSRF) vulnerability in its IsInternalIP deny list function (file: internal/tools/net.go). The deny list fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix , all...
CVE-2026-84697 Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...
CVE-2026-84697 Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to...
CVE-2026-67447
creationtimestamp| type| source ---|---|--- 2026-08-20 22:35:02+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-r553-m4fv-5v97...
CVE-2026-67447
Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...
CVE-2026-67448
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...
GHSA-8R62-W5WH-FC5M Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...