[GH-ISSUE #635] CVE-2025-15467 #399

New issue

Closed

opened 2026-03-15 14:14:45 +03:00 by kerem · 3 comments

kerem commented

2026-03-15 14:14:45 +03:00

Owner

Originally created by @Namoshek on GitHub (Jan 29, 2026).
Original GitHub issue: https://github.com/axllent/mailpit/issues/635

Recently a critical critical CVE-2025-15467 has been published. According to Trivy, the Mailpit image is affected.

Whether this CVE is applicable to Mailpit in the sense that it can be exploited would require its own analysis which is far beyond my scope. However, since the CVE is fixed in the alpine:latest base image, can we simply get a new version with a rebuilt image?

Thanks in advance!

Originally created by @Namoshek on GitHub (Jan 29, 2026). Original GitHub issue: https://github.com/axllent/mailpit/issues/635 Recently a critical critical [CVE-2025-15467](https://avd.aquasec.com/nvd/2025/cve-2025-15467/) has been published. According to Trivy, the Mailpit image is affected. Whether this CVE is applicable to Mailpit in the sense that it can be exploited would require its own analysis which is far beyond my scope. However, since the CVE is fixed in the `alpine:latest` base image, can we simply get a new version with a rebuilt image? Thanks in advance!

kerem closed this issue

2026-03-15 14:14:50 +03:00

kerem commented

2026-03-15 14:14:56 +03:00

Author

Owner

@axllent commented on GitHub (Jan 29, 2026):

Hi @Namoshek - thanks for the heads-up. Whilst I haven't released a new Mailpit version as such, I have rebuilt & pushed the axllent/mailpit:latest, axllent/mailpit:v1.28.4, axllent/mailpit:v1.28 and the axllent/mailpit:edge docker images, so these images should all be clear of this CVE (or any others at the moment) 👍 I hope this unblocks you?

@axllent commented on GitHub (Jan 29, 2026): Hi @Namoshek - thanks for the heads-up. Whilst I haven't released a new Mailpit version as such, I have rebuilt & pushed the `axllent/mailpit:latest`, `axllent/mailpit:v1.28.4`, `axllent/mailpit:v1.28` and the `axllent/mailpit:edge` docker images, so these images should all be clear of this CVE (or any others at the moment) 👍 I hope this unblocks you?

kerem commented

2026-03-15 14:15:01 +03:00

Author

Owner

@Namoshek commented on GitHub (Jan 30, 2026):

I assumed creating a new tag is the simpliest solution, but your option works for us as well. Thanks for the quick fix!

@Namoshek commented on GitHub (Jan 30, 2026): I assumed creating a new tag is the simpliest solution, but your option works for us as well. Thanks for the quick fix!

kerem commented

2026-03-15 14:15:06 +03:00

Author

Owner

@axllent commented on GitHub (Jan 30, 2026):

Absolutely, a new tag is probably easiest (although it does require a socket pull), however given that there are no actual changes to the code I felt it better to just refresh the docket versions. Again, thank you for the cve alert.

@axllent commented on GitHub (Jan 30, 2026): Absolutely, a new tag is probably easiest (although it does require a socket pull), however given that there are no actual changes to the code I felt it better to just refresh the docket versions. Again, thank you for the cve alert.