mailcow-dockerized before version 2026-03b suffers from a second-order SQL injection vulnerability due to improper input validation and unsafe string formatting in SQL queries. The quarantine_category field is accepted without sanitization via the API and later used unsafely in quarantine_notify.py, enabling attackers to inject arbitrary SQL commands. Exploitation can result in disclosure of sensitive information by injecting UNION SELECT statements that appear in notification emails. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity.

Successful exploitation allows an attacker with high privileges to inject arbitrary SQL commands into the mailcow database during the quarantine notification process. This can lead to disclosure of sensitive data, including administrative credentials, through crafted quarantine notification emails. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known exploits in the wild as of the published date.

Upgrade mailcow-dockerized to version 2026-03b or later, where this vulnerability is fixed. Since the vendor advisory or patch links are not explicitly provided, verify the upgrade from official mailcow sources. Patch status is not explicitly confirmed in the provided data, but the description states version 2026-03b fixes the issue. No alternative mitigations are indicated.