PT-2026-94112

CVE-2026-92595

Published

2026-09-08

Updated

2026-09-19

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 9.1.1

Description The software fails to honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent() using the legacy three-argument signature resolveContent(data, key, callback). This occurs because shared.resolveContent() normalizes the missing options argument to an empty object, causing the resolveContentValue() function to skip access-control checks and reach nmfetch(url) or fs.createReadStream(path). Consequently, application or plugin code resolving untrusted content (such as html, text, attachment path, or href) can be manipulated to read arbitrary local files or perform server-side request forgery (SSRF), which is when an attacker induces a server to make requests to an unintended location, bypassing the enabled sandbox.

Recommendations Update to version 9.1.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Hcamael

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-918: Server-Side Request Forgery (SSRF)