Description
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mailcow | mailcow-dockerized | < 2025-01a | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- mailcow 2025-01a - Host Header Password Reset Poisoning EDB-52485 · webapps · Mar 3, 2026
GitHub 2 repositories
-
Groppoxx/CVE-2025-25198-PoC ★ 19 · Oct 14, 2025
PoC for CVE-2025-25198: automated Host header poisoning test for Mailcow - HTTPS listener, automatic cookie/CSRF handling, captures first reset link.
-
enzocipher/CVE-2025-25198 ★ 0 · Oct 14, 2025
Captures password reset tokens from Mailcow Host header injection attacks.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.