CVE-2026-45711 Details
Description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.
A path traversal vulnerability allowing arbitrary file writes has been identified in Mailpit versions prior to 1.30.0. The issue arises in the 'mailpit dump --http <base-url> <out-dir>' sub-command, which downloads messages from a remote Mailpit instance and saves them as .eml files in a user-specified directory. The vulnerability is exploited by a malicious HTTP server that impersonates Mailpit, manipulating the message ID to traverse directories and write files to locations outside the intended output directory. This could overwrite sensitive files such as cron jobs or CI artifacts, and potentially execute code if the written file is executed as a script.
Users are advised to upgrade to Mailpit version 1.30.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j | CISA-ADP | ExploitVendor Advisory |
| https://github.com/axllent/mailpit/releases/tag/v1.30.0 | [email protected] | Release Notes |
| https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axllent mailpit | < 1.30.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |