CVE-2026-45711: falha de média gravidade em axllent mailpit
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 0.4%
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Produtos afetados
axllent · mailpitCVEs relacionadas — axllent mailpit
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23829MEDIUMMailpit has SMTP Header Injection via Regex BypassEPSS 1.4%CVE-2026-21859MEDIUMMailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)EPSS 0.8%CVE-2026-45713HIGHMailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizesEPSS 0.6%CVE-2026-48824MEDIUMMailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)EPSS 0.5%CVE-2026-27808MEDIUMMailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check APIEPSS 0.5%CVE-2026-67447MEDIUMMailpit: SMTP DATA line reader buffers over-limit input before size enforcementEPSS 0.5%