CVE-2026-23829 Scanner

Mailpit is a popular email server used by various companies and individuals for sending and receiving emails. Its versatility and ease of use have made it favorable among many server administrators. The software is primarily used to test, debug, and manage email workflows in development settings. As such, it plays a vital role in ensuring that email communication within an organization functions smoothly and efficiently. However, like any other software, it needs to be kept secure to prevent exploitation by malicious attackers. This is critically important as Mailpit is often exposed to the internet, making it susceptible to external threats.

The CRLF Injection vulnerability detected in Mailpit affects versions prior to 1.28.2. This security issue arises from insufficient validation of SMTP header inputs, specifically the `RCPT TO` and `MAIL FROM` fields. It allows attackers to inject arbitrary SMTP headers by crafting custom email addresses. This can corrupt existing headers and result in malformed email data, posing a potential threat to email integrity. Such vulnerabilities require prompt attention to prevent any possible exploitation.

The vulnerability within Mailpit occurs due to insufficient regex validation of SMTP headers. Specifically, the vulnerability permits attackers to inject arbitrary SMTP headers through the `RCPT TO` and `MAIL FROM` addresses on the Mailpit SMTP server. This flaw is attributed to the lack of filtering for inappropriate control characters within email addresses. Attackers can exploit this vulnerability by sending crafted email addresses to introduce additional headers, effectively compromising the integrity and security of email content.

If exploited, the CRLF Injection vulnerability could result in several adverse effects. Malicious actors could inject unauthorized headers into captured emails, potentially compromising the email's authenticity. Additionally, this could corrupt existing headers, such as the "Received" header, affecting the trustworthiness of the emails. Furthermore, malformed .eml files could be generated, causing potential disruptions in email processing and delivery workflows. The exploitation also violates the constraints outlined in RFC 5321, which prohibits control characters in envelope addresses, potentially leading to compliance issues.

REFERENCES

• https://rosecurify.com/advisories/RO-26-002-mailpit-smtp-header-injection/
• https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c