CVE-2026-23829
MEDIUM NUCLEIMailpit < 1.28.3 - SMTP Header Injection via RCPT TO and MAIL FROM Address Validation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-23829. PoCs published by XiaomingX, SimoesCTT. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-23829, a CRLF injection vulnerability in Mailpit's SMTP server. The exploit demonstrates the vulnerability and includes a novel phase-based reconstruction technique to recover the original SMTP command from corrupted logs.
Description
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (`\r`) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude `\r` and `\n` when used inside a character class. Version 1.28.3 fixes this issue.
Exploits (3)
This repository contains a functional exploit for CVE-2026-23829, a CRLF injection vulnerability in Mailpit's SMTP server. The exploit demonstrates the vulnerability and includes a novel phase-based reconstruction technique to recover the original SMTP command from corrupted logs.
This repository contains a functional exploit for CVE-2026-23829, a CRLF injection vulnerability in Mailpit's SMTP server, combined with a novel phase-based reconstruction technique using Convergent Time Theory (CTT). The exploit demonstrates both the vulnerability and a method to recover corrupted data.
This PoC exploits CVE-2026-23829 in Mailpit SMTP Server by leveraging header injection to achieve RCE, with additional features like temporal resonance and worm propagation. The exploit uses SMTP protocol manipulation and embedded payloads to execute commands and establish persistence.
Nuclei Templates (1)
title:"Mailpit"
title="Mailpit"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N