CVE-2024-27448: Maildev

Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days.

MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js writing arbitrary code into the routes.js file.

Affected products

• Maildev Maildev: from 2.0.0, up to and including 2.1.0

Published 2024-04-05. Last modified 2026-06-17.