Mailpit, an email testing and API tool, contains a flaw in its /proxy endpoint that allows a server‑side request forgery attack; an attacker can submit an HTTP or HTTPS URL and the endpoint forwards the request without validating the target. This enables indirect access to internal network services, restricted APIs, or data that would otherwise be unreachable from the public Internet. The vulnerability is identified as CWE‑918 and is limited to HTTP GET requests with minimal headers.

All axllent Mailpit releases up to and including 1.28.0 are vulnerable; the issue was fixed in 1.28.1, and any deployment of that version or newer is no longer affected.

The CVSS score of 5.8 indicates moderate severity while the EPSS score of 1% suggests a low but non‑zero exploitation probability. The CVE description does not specify whether authentication is required to use the /proxy endpoint, so it is unclear whether an unauthenticated attacker can trigger the SSRF without credentials. The SSRF flaw nevertheless allows an attacker who can reach the Mailpit server to perform internal reconnaissance, lateral movement, or to access internal services or APIs that would otherwise be inaccessible from the public Internet. The vulnerability is not listed in the CISA KEV catalog, reducing automated alerting but not eliminating the risk.