GHSA-mpf7-p9x7-96r3
Medium · 5.8CVSS
5.8
EPSS
—
Published
Feb 26, 2026
CISA due date
—
The record
Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/axllent/mailpit | 0 | 1.29.2 |
Related vulnerabilities
- CVE-2026-27808 Mailpit is an email testing tool and API for developers. Same vulnerability
- GO-2026-4333 Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit Also affects github.com/axllent/mailpit
- GO-2026-4345 Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in… Also affects github.com/axllent/mailpit
- GO-2026-4310 Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated… Also affects github.com/axllent/mailpit
- CVE-2026-23845 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- CVE-2026-23829 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit
- GO-2026-4284 Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in… Also affects github.com/axllent/mailpit
- CVE-2026-22689 Mailpit is an email testing tool and API for developers. Also affects github.com/axllent/mailpit