CVE-2026-23845

Published January 19th, 2026

View on NVD ↗

CVSS v3

5.8

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.

axllent/mailpit

An email and SMTP testing tool with API for developers

GitHub

9.59K