CVE-2020-23776: Winmail Project Winmail

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request.

Affected products

• Winmail Project Winmail: version 6.5 only

Published 2021-01-26. Last modified 2026-06-17.