Skip to main content
ExploitPublished

mailcow 2025-01a - Host Header Password Reset Poisoning

Source Exploit-DB RSS Feed

0
Severity
Medium

Rated by Threat Radar

Data as of 10 Apr 2026, 00:24 UTC

What to do

AI-suggested

Until an official fix is available, users should consider implementing strict Host header validation or other protective measures in their deployment. Monitor vendor channels for updates and apply patches promptly once released.

Description

mailcow 2025-01a - Host Header Password Reset Poisoning

Indicators of compromise

Exploit source code

Exploit code for mailcow 2025-01a - Host Header Password Reset Poisoning21,243 characters
# Exploit Title: mailcow 2025-01a - Host Header Password Reset Poisoning
# Date: 2025-10-21
# Exploit Author: Iam Alvarez (AKA Groppoxx / Maizeravla)
# Vendor Homepage: https://mailcow.email
# Software Link: https://github.com/mailcow/mailcow-dockerized
# Version: < 2025-01a  (REQUIRED)
# Tested on: Ubuntu 22.04.5 LTS, Docker 26.1.3, Docker Compose 2.27.1; mailcow:dockerized 2025-01
# CVE : CVE-2025-25198
# PoC: https://github.com/Groppoxx/CVE-2025-25198-PoC.git
# mailcow: dockerized < 2025-01a …

References

Community reviews

Loading reviews…