CVE-2026-125757
CriticalCVSS 9.1Summary
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Risk Assessment
A domain administrator can gain control over the shared rspamd container, compromising the confidentiality and integrity of all tenants' mail and allowing filtering to be disabled.
Recommendation
Update mailcow to a version containing the fix (after 2026-11) and restrict domain administrator privileges where possible.
Other vulnerabilities in mailcow
See all- CVE-2017-8928High
Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.
- CVE-2026-40878Low
In mailcow versions prior to 2026-03b, the web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of context-appropriate JS escaping. Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
- CVE-2026-40874Medium
In mailcow versions prior to 2026-03b, no administrator verification occurs when deleting Forwarding Hosts via /api/v1/delete/fwdhost. Any authenticated user can call this API, potentially significantly disrupting the mail service.
- CVE-2023-34108High
A vulnerability has been discovered in mailcow, a mail server suite, that allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue arises from the behavior of the `passwd-verify.lua` script, which verifies user passwords during login attempts.
Original NVD description (English source)
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS