by Kastro
Paper/Archive/CVE-2026-125757

CVE-2026-125757

mailcow mailcow: dockerized — mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

public exploitCVSS 9.4
critical.is priorityof 100
38
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0No EPSS score.000 × 200.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.

Affected

ProductAffectedFixed inSource
mailcow: dockerized< 2026-112026-11CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jgr3-fv33-x43cpatchgithub.com/mailcow/mailcow-dockerized/commit/e986803980db8b29435a2ddba5d9760737a818e3refgithub.com/mailcow/mailcow-dockerized/releases/tag/2026-11writeupgithub.com/mailcow/mailcow-dockerized/blob/55982ac74bfd35581cc44b122ab5fc659e3ae90a/data/conf/rspamd/lua/rspamd.local.lua#L847-L850writeupvulncheck.com/advisories/mailcow-dockerized-before-2026-11-template-injection-rce-via-domain-wide-footer