CVE-2026-45711
Received Received - Intake

Path Traversal in Mailpit Email Testing Tool

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45711
EUVD
EUVD-2026-45967

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
axllent mailpit 1.30.0
axllent mailpit to 1.29.8 (exc)
axllent mailpit to 1.30.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45711 is a path traversal vulnerability in Mailpit versions prior to 1.30.0. The mailpit dump --http command downloads messages from a remote Mailpit instance and saves them as .eml files in a user-specified directory. However, the message ID from the remote server is used directly to construct the file path without validation, allowing path traversal sequences like ../../../../etc/cron.d/payload.eml to escape the intended output directory.

Detection Guidance

Check Mailpit version with `mailpit --version`. If it is below 1.30.0, the system is vulnerable. Review file writes in the output directory of `mailpit dump --http` for unexpected paths or files outside the intended directory.

Impact Analysis

An attacker controlling a malicious Mailpit server can exploit this to write arbitrary files to any location writable by the user running the command. This could overwrite critical files like cron jobs, shell configurations, or web roots, potentially enabling code execution depending on user privileges.

Compliance Impact

This vulnerability could lead to unauthorized file writes outside the intended directory, potentially exposing or modifying sensitive data. For GDPR, this may violate integrity and confidentiality principles if personal data is altered or accessed improperly. For HIPAA, it could risk unauthorized access to protected health information if files containing such data are overwritten or exposed.

Mitigation Strategies

Upgrade Mailpit to version 1.30.0 or later immediately. Avoid using the `mailpit dump --http` command with untrusted Mailpit servers. Restrict write permissions for users running Mailpit to minimize potential damage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart