CVE-2026-23845

Published: Jan 19, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.

Affected (1)

Products: Axllent: Mailpit

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Axllent Mailpit	Before 1.28.3

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://github.com/axllent/mailpit/commit/1679a0aba592ebc8487a996d37fea8318c984dfe

Source: security-advisories@github.com

Patch

https://github.com/axllent/mailpit/releases/tag/v1.28.3

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.