CVE-2026-1257579.4Critical
CVE-2026-125757: mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
mailcow · mailcow: dockerized
Vendor fix available · Affected: mailcow: dockerized · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
9.4CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 10 Nov.
- Mailcow fixes five flaws, including cross tenant RCESecurityOnline · first in our coverage
New articles also arrive in the RSS feed.