CVE-2026-125757 mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
CriticalCVSS 9.4
- Published
- Updated
- Exploit status
- No public exploit known
Description
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mailcow-dockerized | < 2026-11 | 2026-11 |
References
- GitHub Security Advisory (GHSA-jgr3-fv33-x43c) exploit vendor-advisory
- github.com patch
- mailcow: dockerized 2026-11 Release Notes release-notes
- github.com technical-description
- VulnCheck Advisory: mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer third-party-advisory