Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The message ID field is taken verbatim from the JSON response of the remote server and concatenated into the output path with path.Join, which silently normalizes `..` segments. A malicious HTTP server impersonating Mailpit can therefore make mailpit dump write attacker-controlled bytes to any path the running user can write, fully outside the intended output directory. Version 1.30.0 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨*CVE* CVE-2026-45711 Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http
Post summary
The tweet only references a CVE and a software version, lacking any substantive detail, exploit code, or patch information.
CVE-2026-45711 Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message fro… https://www.cve.org/CVERecord?id=CVE-2026-45711
Post summary
The entry notes that Mailpit’s pre‑1.30.0 dump command exposes all messages, but does not provide proof of concept, exploit code, patch details, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axllent | mailpit | - | - | - |