mailcow vulnerabilities

Products

• mailcow-dockerized 22
• mailcow dockerized 16

Latest mailcow CVEs

Newest publication first

1. CVE-2026-125757 mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

   Published 2026-11-10

   Critical·CVSS 9.4 EPSS 0.82%

   mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default...

2. CVE-2026-7460 mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped

   Published 2026-05-20

   High·CVSS 7.4 EPSS 0.32%

   mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fi...

3. CVE-2026-40878 mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping

   Published 2026-04-21

   Low·CVSS 2.1 EPSS 0.80%

   mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() he...

4. CVE-2026-40875 mailcow: dockerized vulnerable to stored XSS in user login history real_rip

   Published 2026-04-21

   High·CVSS 7.0 EPSS 0.24%

   mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP head...

5. CVE-2026-40874 mailcow: dockerized missing authorization on Forwarding Hosts delete action

   Published 2026-04-21

   Medium·CVSS 6.0 EPSS 0.17%

   mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with /api/v1/delete/fwdhost. Any authenticated user can call this API. Checks are only applied for...

6. CVE-2026-40873 mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames

   Published 2026-04-21

   High·CVSS 8.9 EPSS 0.42%

   mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted...

7. CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

   Published 2026-04-21

   Critical·CVSS 9.3 EPSS 0.36%

   mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover requ...

8. CVE-2026-40871 mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API

   Published 2026-04-21

   High·CVSS 7.2 EPSS 8.6%

   mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without valida...

9. CVE-2025-53909 mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

   Published 2025-07-17

   High·CVSS 7.2 EPSS 0.54%

   mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template renderi...

10. CVE-2025-25198 mailcow: dockerized vulnerable to password reset poisoning

    Published 2025-02-12

    High·CVSS 8.8 EPSS 1.1%

    mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-contro...

11. CVE-2024-41960 Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized

    Published 2024-08-05

    Medium·CVSS 4.8 EPSS 0.33%

    mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts configuration. The injected payload is executed whenever the configuration page is viewed, enabling the attacker to execut...

12. CVE-2024-41959 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized

    Published 2024-08-05

    Medium·CVSS 6.1 EPSS 0.35%

    mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in...

13. CVE-2024-41958 Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

    Published 2024-08-05

    High·CVSS 7.2 EPSS 1.0%

    mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized access to other accoun...

14. CVE-2024-31204 mailcow Cross-site Scripting Vulnerability via Exception Handler

    Published 2024-04-04

    Medium·CVSS 6.1 EPSS 8.2%

    mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability resides in the exception handling mechanism, specifically when not operating in DEV_MODE. T...

15. CVE-2024-30270 mailcow Path Traversal and Arbitrary Code Execution Vulnerability

    Published 2024-04-04

    Medium·CVSS 6.2 EPSS 27.3%

    mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the...

16. CVE-2024-24760 Mailcow Docker Container Exposure to Local Network

    Published 2024-02-02

    High·CVSS 7.3 EPSS 0.87%

    mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect to exposed ports of...

17. CVE-2024-23824 mailcow ipixel flood attack leads to Denial of Service in admin page

    Published 2024-02-02

    Low·CVSS 2.7 EPSS 0.60%

    mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is t...

18. CVE-2023-49077 mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

    Published 2023-11-30

    Medium·CVSS 6.1 EPSS 0.44%

    Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the Quarantine feature....

19. CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

    Published 2023-06-07

    High·CVSS 8.8 EPSS 0.98%

    mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using special...

20. CVE-2023-26490 mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​

    Published 2023-03-03

    High·CVSS 8.8 EPSS 2.2%

    mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this...

21. CVE-2022-39258 mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

    Published 2022-09-27

    High·CVSS 8.2 EPSS 1.8%

    mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phis...

22. CVE-2022-31138 OS Command Injection in mailcow

    Published 2022-07-11

    High·CVSS 8.8 EPSS 3.3%

    mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengt...

23. CVE-2022-31245 mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

    Published 2022-05-20

    High·CVSS 8.8 EPSS 5.6%

    mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

24. CVE-2017-8928 mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

    Published 2017-05-14

    High·CVSS 8.8 EPSS 2.0%

    mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.