mailcow-dockerized before version 2026-03b suffers from an improper neutralization of input during web page generation (CWE-79). Specifically, the raw $_SERVER['REQUEST_URI'] is passed to Twig as a global template variable and rendered inside a JavaScript string literal in the setLang() helper of base.twig. The default HTML auto-escaping in Twig is insufficient for JavaScript context, leading to potential XSS. Furthermore, the query_string() Twig helper merges all current $_GET parameters into language-switching links on the login page, allowing attacker-supplied parameters to be reflected and persist across navigation. The vulnerability is resolved in version 2026-03b.

An attacker can inject malicious scripts via crafted URLs or GET parameters that are reflected in the web interface's JavaScript context and language-switching links. This could lead to cross-site scripting attacks with limited impact due to the low CVSS score (2.1). Exploitation requires user interaction and results in low confidentiality, integrity, and availability impact. No known exploits are reported in the wild.

Upgrade mailcow-dockerized to version 2026-03b or later, where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details, applying this official fix is the recommended action. Patch status is not explicitly confirmed beyond the version fix note; verify with the vendor advisory for the latest remediation guidance.