Open Redirect in Mailcow Mailcow\
CVE-2025-25198
mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings.
Vulnerability class: Open Redirect
EPSS: 0.011 (63.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.
Affected products
- Mailcow Mailcow\ — versions _dockerized
- Mailcow Mailcow-dockerized — versions < 2025-01a
- Mailcow Mailcow\:_dockerized
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-25198?
- CVE-2025-25198 is a high-severity vulnerability in Mailcow Mailcow\, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 7.1/10. Published 2025-02-12.
- How severe is CVE-2025-25198?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2025-25198 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.