File attachments

MIME

There is one standard technique for sending multimedia through email, it’s called MIME and mutt supports both sending and receiving it. MIME is an acronym for Multipurpose Internet Mail Extensions; you should read a MIME overview if you are interested in how it works and why it came to exist.

~/.mailcap

Mutt, like many other mime aware tools, refers to the mailcap configuration file for instructions on viewing different types of mime-encoded mail attachments.

There are two likely locations for your mailcap file; /etc/mailcap for system-wide settings and ~/.mailcap where you should add entries you create or modify as a normal user. A line looks like this:

application/pdf; zathura %s; test=test -n "$DISPLAY"

Full instructions are in the mailcap section of the manual, and there is a worked example in contrib/sample.mailcap.

Mutt restricts what it will substitute into a mailcap command, which stops a crafted filename turning into a shell command. Leave this alone:

set mailcap_sanitize = yes

Viewing file attachments in mutt

Mutt has the ability to view any attachment inline in the pager - As long as you have an appropriate tool that can convert the attachment to plain text.

Specify which mime-types you want to view inline with the auto_view command. Word processor documents, rich-text files, HTML mail and even images can be viewed in this way, given the right helper. Add a copiousoutput entry to your mailcap file for each type, then list the types in your muttrc:

auto_view text/html
alternative_order text/plain text/enriched text/html

The alternative_order line tells mutt which part of a multipart/alternative message to prefer, so that mail sent as both text and HTML shows you the text version.

HTML mail

Most mail is now sent as HTML whether you want it or not. The usual arrangement is to render it to text with a terminal browser. Put this in ~/.mailcap :

text/html; w3m -I %{charset} -T text/html -dump; copiousoutput;

and the auto_view text/html line above in your muttrc. w3m is the usual choice because it makes a decent job of tables; lynx and elinks work the same way.

Note the -dump : the renderer must not be allowed to fetch anything over the network. Remote images in mail are tracking pixels, and in encrypted mail they are worse than that - see the cryptography section.

Fixing broken Content-Type:

A common problem, particularly with mailers that rely on file extensions for identifying content-types, is that attachments arrive mis-labelled as the generic application/octet-stream.

You can fix the content-type of a mime part for the current message using the edit-type command, bound to Ctrl-e in the attach menu.

Going the other way, when mutt attaches a file to a new email it guesses the content-type from the mime.types file. The system file is normally /etc/mime.types ; add your own entries to ~/.mime.types. If mutt still gets it wrong, have it ask the system instead of guessing from the extension:

set mime_type_query_command = "file --mime-type -b %s"

Content-Disposition

By default mutt labels non-text attachments as Content-Disposition: attachment , which tells the recipient’s mailer to offer it as a file rather than display it in the message. Graphical mailers respect this. If you want an image shown in place instead, change the setting for that attachment with the toggle-disposition command, bound to Ctrl-d in the compose menu.

Viruses, worms and security

If you think that using mutt and a unix-variant makes you immune to the virus and worm problems experienced elsewhere, then you are certainly mistaken. Mutt does its best not to allow messages, which should be considered tainted, to become executable. However, there are many other potential weak points in any system - your mailcap settings may route attachments via tools that were never designed to handle corrupt or malicious data, or there may be security issues with the tools that were.

The rules that matter are short:

• Never put needsterminal on a mailcap entry for something you haven’t thought hard about, and never write one that pipes an attachment into a shell.
• Don’t let a renderer fetch remote content.
• Be suspicious of auto_view for formats with scripting in them, which is most office document formats.

The manual has a whole security considerations chapter covering this, temporary files, and the ways a message can leak information about you. It is short and worth reading once.

Last updated 31 August 2026.