CVE-2026-21859 PoC — Mailpit 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21859.yaml

Associated Vulnerability

Title:Mailpit 代码问题漏洞 (CVE-2026-21859)
Description:Mailpit是Ralph Slooten个人开发者的一个电子邮件测试工具。 Mailpit 1.28.0及之前版本存在代码问题漏洞，该漏洞源于/proxy端点存在服务端请求伪造，允许攻击者访问内部网络资源。

Description

Mailpit <= 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests.

File Snapshot


 id: CVE-2026-21859

info:
  name: Mailpit < 1.28.3 - Server-Side Request Forgery
  author: omarkurt


...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!