CVE-2026-23845— Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API
Quick assessment
Affected
axllent mailpit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mailpit是Ralph Slooten个人开发者的一个电子邮件测试工具。 Mailpit 1.28.3之前版本存在代码问题漏洞，该漏洞源于HTML Check功能中的inlineRemoteCSS函数可下载外部CSS文件，可能导致服务端请求伪造攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-23845
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API
Source: CVE Program / CVE List V5
Vulnerability Description
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Mailpit 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mailpit是Ralph Slooten个人开发者的一个电子邮件测试工具。 Mailpit 1.28.3之前版本存在代码问题漏洞，该漏洞源于HTML Check功能中的inlineRemoteCSS函数可下载外部CSS文件，可能导致服务端请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-23845
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23845
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-23845 (1)
IV. Related Vulnerabilities
Same product: mailpit
-
CVE-2026-84697
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Pr -
CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded p -
CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input befo -
CVE-2026-67445
Mailpit: SMTP command parser buffers unbounded command lines -
CVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimens
Same vendor: axllent
-
CVE-2026-84697
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Pr -
CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded p -
CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input befo -
CVE-2026-67445
Mailpit: SMTP command parser buffers unbounded command lines -
CVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimens
Same weakness: CWE-918
-
CVE-2026-39989
SSRF in QNAP Download Station -
CVE-2026-3712
PhastPress <= 3.10 - Unauthenticated Server-Side Request For -
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and custom -
CVE-2026-0311
Checkov by Prisma Cloud: Server-Side Request Forgery Vulnera -
CVE-2026-55385
InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer ho
V. Comments for CVE-2026-23845
No comments yet