CVE-2026-23845

Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. During this process, the `inlineRemoteCSS()` function automatically downloads CSS files from external `<link rel="stylesheet" href="...">` tags to inline them for testing. Version 1.28.3 fixes the issue.

• CWE-918

• https://github.com/axllent/mailpit/commit/1679a0aba592ebc8487a996d37fea8318c984dfePatch
• https://github.com/axllent/mailpit/releases/tag/v1.28.3Product, Release Notes
• https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5jExploit, Vendor Advisory

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2384The Quiz Maker plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-23840Movary is a web application to track, rate and explore your …6.1
• CVE-2026-23841Movary is a web application to track, rate and explore your …6.1
• CVE-2026-23842ChatterBot is a machine learning, conversational dialog engi…7.5
• CVE-2026-23843teklifolustur_app is a web-based PHP application that allows…7.1
• CVE-2026-23844Whisper Money is a personal finance application. Versions pr…4.3
• CVE-2026-23846Tugtainer is a self-hosted app for automating updates of Doc…9.1
• CVE-2026-23847SiYuan is a personal knowledge management system. Versions p…6.1
• CVE-2026-23848MyTube is a self-hosted downloader and player for several vi…5.3
• CVE-2026-23849File Browser provides a file managing interface within a spe…5.3
• CVE-2026-2385The The Plus Addons for Elementor – Addons for Elementor, Pa…5.3
• CVE-2026-23850SiYuan is a personal knowledge management system. In version…7.5