Mailpit’s SMTP server accepted email addresses that contain carriage return characters because the validation regular expression omitted \r and \n when filtering control characters. This flaw lets an attacker embed CRLF sequences in the RCPT TO or MAIL FROM addresses, which causes the SMTP engine to interpret the injected characters as header delimiters. The result is that an attacker can add arbitrary SMTP headers or corrupt existing ones, potentially forging authentication headers, redirecting email flows, or enabling spam and phishing campaigns. An attacker can exploit this by connecting to the SMTP interface, authenticating if required, and sending a crafted RCPT TO or MAIL FROM command containing CRLF characters.

The vulnerability affects the axllent Mailpit email testing tool. All releases prior to version 1.28.3 are impacted, as the buggy regular expression is present in those builds. Version 1.28.3 and later incorporate a corrected regex that properly excludes forbidden control characters.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. Mailpit exposes an SMTP interface to network clients, so the attack vector is remote via the SMTP protocol, inferred from the fact that the product is an SMTP server; this is not directly stated but can be deduced from the product description. The vulnerability is not currently listed in CISA’s KEV catalog, implying no known active exploitation at this time. Systems that remain unpatched could be used to subvert email delivery by injecting malicious headers.