Most recent entries from all

EUVD-2026-265218

2026-10-18T20:37:44.863843+00:00

EUVD-2026-265218

fkie_cve-2026-21859

2026-10-18T20:37:44.863879+00:00

Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (SSRF) vulnerability in the /proxy endpoint, allowing attackers to make requests to internal network resources. The /proxy endpoint validates http:// and https:// schemes, but it does not block internal IP addresses, enabling attackers to access internal services and APIs. This vulnerability is limited to HTTP GET requests with minimal headers. The issue is fixed in version 1.28.1.

GHSA-8v65-47jx-7mfr — Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability

2026-10-18T20:37:44.863925+00:00

Affected: Go: github.com/axllent/mailpit

## Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in Mailpit's `/proxy` endpoint that allows attackers to make requests to internal network resources.

## Description

The `/proxy` endpoint allows requests to internal network resources. While it validates `http://` and `https://` schemes, it does not block internal IP addresses, allowing attackers to access internal services and APIs.

## Proof of Concept

### Basic SSRF Request ``` GET /proxy?url=http://127.0.0.1:8025/api/v1/info ```

This returns internal API data including database path and runtime statistics. ## Impact Assessment

### 1. Internal Network Scanning Attacker can probe and discover internal services on the network.

### 2. Information Disclosure Access to internal API data, database paths, and runtime statistics.

### 3. Email Content Access Ability to read all captured emails via internal API endpoints.

### 4. Cloud Metadata Access If deployed in cloud environments (AWS/GCP/Azure), potential access to instance metadata services (e.g., `http://169.254.169.254/`).

## Attack Scenarios

### Scenario 1: Development Environment Exposure If Mailpit is accidentally exposed to the internet, attackers can leverage SSRF to access internal development resources and services.

### Scenario 2: Container Escape Information In containerized deployments, SSRF can reveal container metadata and internal service configurations.

### Scenario 3: Lateral Movement In corporate networks, SSRF can be used t…

WID-SEC-W-2026-0018 — MailPit: Schwachstelle ermöglicht Offenlegung von Informationen

2026-10-18T20:37:44.864029+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MailPit ausnutzen, um Informationen offenzulegen.