CVE-2026-23845
Medium · 5.8CVSS
5.8
EPSS
0.4%
Published
Jan 19, 2026
CISA due date
—
The record
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/axllent/mailpit | 0 | 1.28.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4345 Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in… Same vulnerability
- GHSA-mpf7-p9x7-96r3 Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API Also affects github.com/axllent/mailpit
- CVE-2026-27808 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- GO-2026-4333 Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit Also affects github.com/axllent/mailpit
- GO-2026-4310 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated… Also affects github.com/axllent/mailpit
- CVE-2026-23829 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- GO-2026-4284 Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in… Also affects github.com/axllent/mailpit
- CVE-2026-22689 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit