Threat Intelligence Database

CVE-2026-40878 is a low-severity cross-site scripting (XSS) vulnerability in mailcow-dockerized versions prior to 2026-03b. The vulnerability arises because the web interface improperly passes the raw request URI to the Twig template engine and renders it inside a JavaScript string literal without appropriate JavaScript context escaping. Additionally, attacker-controlled GET parameters are reflected and preserved in language-switching links on the login page. This issue was fixed in version 2026-03b.

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.

CVE-2026-40872 is a critical cross-site scripting (XSS) vulnerability in mailcow-dockerized versions prior to 2026-03b. The vulnerability arises because the admin dashboard's Autodiscover logs render the EMailAddress value without HTML escaping, allowing an attacker to submit a crafted email address containing malicious HTML or JavaScript. This payload is stored in Redis and executed when an admin views the Autodiscover logs. The issue is fixed in version 2026-03b.

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injection when the quarantine notification job executes, allowing an attacker to inject arbitrary SQL. Using a UNION SELECT, sensitive data (e.g., admin credentials) can be exfiltrated and rendered inside quarantine notification emails. Version 2026-03b fixes the vulnerability.

mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue.

CriticalVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-53909#cwe-1336