PatchSiren cyber security CVE debrief
CVE-2026-45711 axllent CVE debrief
CVE-2026-45711 is a path traversal vulnerability in Mailpit, an email testing tool and API for developers. The vulnerability exists in the `mailpit dump --http <base-url> <out-dir>` sub-command, which downloads every message from a remote Mailpit instance and writes each one as `<id>.eml` inside the user-supplied output directory. Due to improper handling of the message ID field, an attacker can make Mailpit write to any path the running user can write to, outside the intended output directory. This vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity.
- Vendor
- axllent
- Product
- mailpit
- CVSS
- MEDIUM 5.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-21
Who should care
Developers and administrators using Mailpit versions prior to 1.30.0 should be aware of this vulnerability and take immediate action to update to the patched version. Users of Mailpit should also be cautious when using the `dump` sub-command with untrusted input. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated.
Technical summary
The vulnerability is caused by the use of `path.Join` to construct the output path, which silently normalizes `..` segments. This allows an attacker to manipulate the output path and write to arbitrary locations on the system. The vulnerability has a CVSS score of 5.9 and is classified as MEDIUM severity. Affected systems include Mailpit versions prior to 1.30.0, and the vulnerability can be exploited through the `mailpit dump --http <base-url> <out-dir>` sub-command.
Defensive priority
High
Recommended defensive actions
- Update Mailpit to version 1.30.0 or later
- Use secure output directories and validate user input
- Monitor Mailpit usage and logs for suspicious activity
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
The vulnerability was reported by an unknown source and patched in version 1.30.0 of Mailpit. The CVE record was published on 2026-07-20T16:17:00.333Z and last modified on 2026-07-21T20:25:45.920Z. Evidence is limited, and defenders should verify Mailpit usage and logs for suspicious activity related to the `dump` sub-command.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T16:17:00.333Z and has not been modified since then.