Mailpit versions before 1.30.0 contain a path traversal vulnerability (CWE-22) in the 'dump --http' sub-command. The command downloads email messages from a remote Mailpit server and writes each message as <id>.eml in a specified output directory. The message ID is used verbatim from the remote JSON response and concatenated into the output path using path.Join, which normalizes '..' segments silently. A malicious HTTP server impersonating Mailpit can exploit this to write files to arbitrary locations writable by the user running mailpit, outside the intended output directory. This vulnerability allows attacker-controlled file writes, impacting integrity and availability. Version 1.30.0 includes a patch that addresses this issue.

An attacker controlling a malicious HTTP server impersonating a Mailpit instance can exploit this vulnerability to cause the mailpit client to write files to arbitrary locations on the local filesystem where the user has write permissions. This can lead to unauthorized file modification or creation, impacting the integrity of the system and potentially causing denial of service. There is no confidentiality impact reported. The CVSS v3.1 score is 5.9 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

A patch is available in mailpit version 1.30.0 that fixes this path traversal vulnerability. Users should upgrade to version 1.30.0 or later to remediate this issue. Until upgraded, users should avoid using the 'mailpit dump --http' sub-command with untrusted or unauthenticated remote Mailpit instances to prevent exploitation.