Path Traversal in Hoppscotch API Development Ecosystem

Executive Summary

CVE-2026-59721 is a critical security vulnerability in the Hoppscotch self-hosted backend that allows an attacker with admin privileges to execute arbitrary commands as root on the backend container.

The issue arises from improper validation of the MAILER_SMTP_URL configuration parameter in the updateInfraConfigs GraphQL mutation. The validateSMTPUrl function permitted SMTP URLs containing path, query, or fragment components, which nodemailer then parsed into sendmail transport options.

An attacker can inject malicious parameters such as path and args into the SMTP URL, which nodemailer uses to spawn commands. When the backend container restarts and sends mail, these injected commands execute with root privileges.

The vulnerability was fixed in version 2026.6.0 by replacing the permissive validation with a stricter approach that only allows basic SMTP URL formats without any additional components.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full compromise of the backend container running Hoppscotch.

• An attacker with admin privileges can execute arbitrary commands as root, gaining complete control over the container.
• Sensitive data such as database credentials and encryption keys stored in the container can be accessed or stolen.
• The attacker may move laterally to other containers on the Docker network, expanding the scope of the compromise.
• The attack requires only one GraphQL mutation and an anonymous sign-in request, making it relatively easy to exploit if admin access is obtained.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the MAILER_SMTP_URL configuration contains suspicious components such as query strings, paths, or fragments that are not normally part of a valid SMTP URL. Specifically, look for parameters like sendmail=true, path=/bin/sh, or args=-c which indicate potential malicious injection.

Since the vulnerability involves the updateInfraConfigs GraphQL mutation, monitoring GraphQL mutation requests for unusual MAILER_SMTP_URL values can help detect exploitation attempts.

Suggested commands to detect suspicious SMTP URL configurations or payloads might include grepping configuration files or logs for MAILER_SMTP_URL values containing unexpected characters or components:

• grep -r 'MAILER_SMTP_URL' /path/to/hoppscotch/config
• grep -E 'path=|args=|sendmail=true' /path/to/hoppscotch/config
• Monitor GraphQL mutation logs for updateInfraConfigs calls with suspicious MAILER_SMTP_URL payloads.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Hoppscotch to version 2026.6.0 or later, where the vulnerability is fixed by stricter SMTP URL validation that rejects any URL components beyond the basic smtp(s)://[user:pass@]host[:port] format.

If upgrading immediately is not possible, manually verify and sanitize the MAILER_SMTP_URL configuration to ensure it does not contain any query strings, paths, fragments, or other suspicious components that could be used to inject commands.

Additionally, restrict admin access to trusted users only, as exploitation requires admin privileges to perform the malicious GraphQL mutation.

Restart the backend container after applying the fix or configuration changes to ensure the mailer service reloads the safe SMTP URL.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-59721 allows an attacker with admin privileges to execute arbitrary commands as root in the backend container, leading to full container compromise and access to sensitive data such as database credentials and encryption keys.

Such a compromise can result in unauthorized access, disclosure, or modification of sensitive personal data, which may violate compliance requirements under standards like GDPR and HIPAA that mandate protection of personal and health information.

Therefore, this vulnerability poses a significant risk to maintaining compliance with these regulations by potentially exposing sensitive data and failing to ensure data confidentiality and integrity.

Useful 0 Not Useful 0