Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.
References
| Link | Resource |
|---|---|
| https://github.com/axllent/mailpit/commit/1679a0aba592ebc8487a996d37fea8318c984dfe | Patch |
| https://github.com/axllent/mailpit/releases/tag/v1.28.3 | Product Release Notes |
| https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j | Exploit Vendor Advisory |
Configurations
History
05 Feb 2026, 18:35
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Axllent mailpit
Axllent |
|
| CPE | cpe:2.3:a:axllent:mailpit:*:*:*:*:*:*:*:* | |
| References | () https://github.com/axllent/mailpit/commit/1679a0aba592ebc8487a996d37fea8318c984dfe - Patch | |
| References | () https://github.com/axllent/mailpit/releases/tag/v1.28.3 - Product, Release Notes | |
| References | () https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j - Exploit, Vendor Advisory |
19 Jan 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-19 19:16
Updated : 2026-02-05 18:35
NVD link : CVE-2026-23845
Mitre link : CVE-2026-23845
CVE.ORG link : CVE-2026-23845
JSON object : View
Products Affected
axllent
- mailpit
CWE
CWE-918
Server-Side Request Forgery (SSRF)