mailcow

6 results · Clear filters · Feed

• Critical 9.1
  CVE-2026-125757 Public exploit

  mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

  mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with a…

  mailcow mailcow-dockerized
  Nov 10, 2026
• High 7.1
  CVE-2025-25198 Public exploit

  mailcow: dockerized vulnerable to password reset poisoning

  mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointin…

  mailcow mailcow-dockerized
  Feb 12, 2025
• Medium 6.6
  CVE-2024-41958 Public exploit

  Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

  mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized a…

  mailcow mailcow-dockerized
  Aug 5, 2024
• Medium 6.2
  CVE-2024-30270 Public exploit EPSS 27%

  mailcow Path Traversal and Arbitrary Code Execution Vulnerability

  mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, speci…

  mailcow mailcow-dockerized
  Apr 4, 2024
• High 8.8
  CVE-2024-24760 Public exploit

  Mailcow Docker Container Exposure to Local Network

  mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect…

  mailcow mailcow-dockerized
  Feb 2, 2024
• High 8.8
  CVE-2022-31138 Public exploit

  OS Command Injection in mailcow

  mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipe…

  mailcow mailcow-dockerized
  Jul 11, 2022