Mailcow vulnerabilities
We track 15 vulnerabilities in Mailcow products across 2 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Mailcow vulnerabilities
- 9.1 Critical severity
mailcow: dockerized: Improper Neutralization of Special Elements Used in a Template Engine
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an
- 7.4 High severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders
- 7.0 High severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trust
- 8.9 High severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an e
- 9.3 Critical severity
mailcow-dockerized: Improper Neutralization of Input During Web Page Generation
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticat
- 7.2 High severity
mailcow: dockerized is an open source groupware/email suite based on docker.
mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_cat
- 7.2 High severity
mailcow-dockerized: Improper Neutralization of Special Elements Used in a Template Engine
mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts.
- 8.8 High severity
mailcow-dockerized: URL Redirection to Untrusted Site
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing
- 7.2 High severity
mailcow-dockerized: Incorrect Comparison
mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized ac
- 7.3 High severity
mailcow-dockerized: Externally Controlled Reference to a Resource in Another Sphere
mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect
- 8.8 High severity
mailcow-dockerized: Improper Neutralization of Special Elements used in an OS Command
mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variab
- 8.8 High severity
mailcow-dockerized: Improper Neutralization of Special Elements used in an OS Command
mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious
- 8.2 High severity
mailcow-dockerized: URL Redirection to Untrusted Site
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credenti
- 8.8 High severity
mailcow-dockerized: Improper Neutralization of Special Elements used in an OS Command
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipem
- 8.8 High severity
Mailcow: Improper Neutralization of Special Elements used in an OS Command
mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.