Most recent entries from all

EUVD-2026-266115

2026-10-06T10:54:52.245786+00:00

EUVD-2026-266115

fkie_cve-2026-23845

2026-10-06T10:54:52.245829+00:00

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `` tags to inline them for testing. Version 1.28.3 fixes the issue.

GHSA-6jxm-fv7w-rw5j — Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API

2026-10-06T10:54:52.245889+00:00

Affected: Go: github.com/axllent/mailpit

### Server-Side Request Forgery (SSRF) via HTML Check CSS Download

The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `` tags to inline them for testing.

#### Affected Components

- **Primary File:** `internal/htmlcheck/css.go` (lines 132-207) - **API Endpoint:** `/api/v1/message/{ID}/html-check` - **Handler:** `server/apiv1/other.go` (lines 38-75) - **Vulnerable Functions:** - `inlineRemoteCSS()` - line 132 - `downloadToBytes()` - line 193 - `isURL()` - line 221

#### Technical Details

**1. Insufficient URL Validation (`isURL()` function):**

```go // internal/htmlcheck/css.go:221-224 func isURL(str string) bool { u, err := url.Parse(str) return err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != "" } ```

**2. Unrestricted Download (`downloadToBytes()` function):**

```go // internal/htmlcheck/css.go:193-207 func downloadToBytes(url string) ([]byte, error) { client := http.Client{ Timeout: 5 * time.Second, }

// Get the link response data resp, err := client.Get(url) // ⚠️ VULNERABLE - No IP validation if err != nil { return nil, err } defer func() { _ = resp.Body.Close() }()

if resp.StatusCode != 200 { err := fmt.Errorf("error downloading %s", url) return nil, err }…

WID-SEC-W-2026-0146 — MailPit: Mehrere Schwachstellen

2026-10-06T10:54:52.246104+00:00

Ein Angreifer kann mehrere Schwachstellen in MailPit ausnutzen, um Dateien zu manipulieren, und um Informationen offenzulegen.