Skip to content
OpenAdvisories

Vendor

mailcow

22 known vulnerabilities.

Products

mailcow-dockerized 22
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-125757 Public exploit

    mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

    mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with a…

    mailcow mailcow-dockerized
  • Critical 9.3
    CVE-2026-40872

    mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

    mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthentica…

    mailcow mailcow-dockerized
  • Critical 9.1
    CVE-2025-53909

    mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

    mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts.…

    mailcow mailcow-dockerized