CVE-2026-67448: CWE-177: Improper Handling of URL Encoding (Hex Encoding) in axllent mailpit

The vulnerability in mailpit stems from a mismatch between the origin check and the routing logic. The origin check is performed on the raw, percent-encoded request URI, while the Go ServeMux router matches on the decoded path. An attacker can craft a request with a percent-encoded path (e.g., /%61pi/events) that bypasses the origin check but is routed to the WebSocket handler. Since the upgrader's CheckOrigin function unconditionally returns true, the WebSocket connection is established without proper origin validation. This allows cross-origin WebSocket hijacking, exposing sensitive email information such as message IDs, sender and recipient addresses, subjects, and body snippets. The vulnerability affects mailpit versions from 1.29.0 up to but not including 1.30.6. The issue was introduced when a previous fix removed CheckOrigin and replaced it with a raw URI prefix check that is bypassable due to URL decoding behavior.

An attacker controlling a malicious website visited by a user running an unauthenticated mailpit instance can establish unauthorized WebSocket connections. This leads to leakage of sensitive email data including IDs, sender and recipient information, subjects, and message snippets. The vulnerability does not require credentials or mail sending capabilities, only that mailpit is running without UI authentication. WebSocket connections bypass CORS protections once established, making the origin check critical. This vulnerability can result in significant confidentiality loss of email content.

No official patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix is to perform origin checks on the decoded URL path (r.URL.Path) rather than the raw request URI, ensuring the origin check aligns with routing. Additionally, restoring a proper CheckOrigin function in the WebSocket upgrader to enforce origin validation independently is recommended. Enabling UI authentication (--ui-auth-file) prevents this bypass by requiring authentication. Until a patch is available, users should enable UI authentication to mitigate risk.