CVE-2026-45711
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs
Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.
INFO
Published Date :
July 20, 2026, 4:17 p.m.
Last Modified :
Oct. 24, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Mailpit to version 1.30.0 or later.
- Ensure Mailpit is running with least privilege.
- Do not download emails from untrusted sources.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-45711.
| URL | Resource |
|---|---|
| https://github.com/axllent/mailpit/releases/tag/v1.30.0 | Release Notes |
| https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j | Exploit Vendor Advisory |
| https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-45711 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-45711
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-45711 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-45711 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: mailpit de axllent, Description: Mailpit es una herramienta de prueba de correo electrónico y API para desarrolladores. Antes de la versión 1.30.0, el subcomando mailpit dump --http [base-url] [out-dir] descarga cada mensaje de una instancia remota de Mailpit y escribe cada uno como [id].eml dentro del directorio de salida proporcionado por el usuario. El campo de ID del mensaje se toma textualmente de la respuesta JSON del servidor remoto y se concatena en la ruta de salida con path.Join, que normaliza silenciosamente los segmentos ’..’. Un servidor HTTP malicioso que suplanta a Mailpit puede, por lo tanto, hacer que mailpit dump escriba bytes controlados por el atacante en cualquier ruta en la que el usuario en ejecución pueda escribir, completamente fuera del directorio de salida previsto. La versión 1.30.0 contiene un parche. -
Initial Analysis by [email protected]
Jul. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Added CPE Configuration OR *cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:* versions up to (excluding) 1.30.0 Added Reference Type GitHub, Inc.: https://github.com/axllent/mailpit/releases/tag/v1.30.0 Types: Release Notes Added Reference Type GitHub, Inc.: https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j Types: Exploit, Vendor Advisory Added Reference Type CISA-ADP: https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j Types: Exploit, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 21, 2026
Action Type Old Value New Value Added Reference https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j Added SSVC {'id': 'CVE-2026-45711', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-21T15:38:53.037071Z'} -
New CVE Received by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'axllent', 'product': 'mailpit', 'versions': [{'status': 'affected', 'version': '< 1.30.0'}]}] Added Description Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L Added CWE CWE-22 Added CWE CWE-829 Added Reference https://github.com/axllent/mailpit/releases/tag/v1.30.0 Added Reference https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j