Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2026-125757 EUVD-2026-121240GHSA-pg35-3wf2-cwx5

mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

Published Nov 10, 2026 · Updated Nov 10, 2026 · Assigned by VulnCheck

Vendor: mailcow Product: mailcow-dockerized

Description

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.

Affected products

VendorProductAffectedFixed
mailcow mailcow: dockerized < 2026-11 2026-11

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Faceless0x7/CVE-2026-125757 ★ 0 · Nov 10, 2026

    CVE-2026-125757 Exploit — mailcow domain-wide footer SSTI via rspamd's jinja/lupa engine, enabling cross-tenant RCE in the shared rspamd container.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References