mailcow mailcow-dockerized before version 2026-03b contains a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability. Specifically, the Quarantine details modal fails to escape attachment filenames before injecting them into HTML, enabling an attacker to execute arbitrary JavaScript in the context of an administrator's browser. This can be exploited by delivering an email with a maliciously crafted attachment name. The vulnerability has a CVSS 4.0 score of 8.9, indicating high severity. No official remediation level or patch link is provided in the data, but version 2026-03b is noted as fixed.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the administrator's browser when viewing quarantine details, potentially leading to account takeover. This compromises the confidentiality and integrity of the administrator's session and access to the mailcow system. The vulnerability affects versions prior to 2026-03b.

Upgrade mailcow mailcow-dockerized to version 2026-03b or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade through the vendor's official channels. Until upgraded, avoid viewing quarantine items with untrusted attachment names or apply manual input sanitization if possible.