Vulnerability in Mailcow Mailcow: Dockerized
CVE-2026-125757
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- Faceless0x7/CVE-2026-125757 (last pushed 2026-11-11): CVE-2026-125757 Exploit — mailcow domain-wide footer SSTI via rspamd's jinja/lupa engine, enabling cross-tenant RCE in the shared rspamd container.
References
- github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-jgr3-fv33-x43c (vendor-advisory)
- github.com/mailcow/mailcow-dockerized/commit/e986803980db8b29435a2ddba5d9760737… (patch)
- github.com/mailcow/mailcow-dockerized/releases/tag/2026-11 (release-notes)
- github.com/mailcow/mailcow-dockerized/blob/55982ac74bfd35581cc44b122ab5fc659e3a… (technical-description)
- www.vulncheck.com/advisories/mailcow-dockerized-before-2026-11-template-injecti… (third-party-advisory)
This CVE has public exploit evidence. See the latest CVEs with public exploits.