CVE-2026-45711

CVE-2026-45711 affects Mailpit and its dump --http sub-command. Before version 1.30.0, Mailpit can write attacker-controlled bytes to arbitrary filesystem paths by using the message ID from the remote server response to construct the output path (path.Join) which normalizes ".." segments. A malic...