Mailcow Mailcow\
16 CVEs affecting Mailcow Mailcow\. Latest disclosed: 2025-07-17. Critical: 1, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53909 | Critical | 9.1 | 2025-07-17 | mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to… |
CVE-2024-24760 | High | 8.8 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affectin… |
CVE-2023-34108 | High | 8.8 | 2023-06-07 | mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulner… |
CVE-2022-31138 | High | 8.8 | 2022-07-11 | mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom pa… |
CVE-2022-31245 | High | 8.8 | 2022-05-20 | mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction… |
CVE-2017-8928 | High | 8.8 | 2017-05-14 | mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF. |
CVE-2023-49077 | High | 8.3 | 2023-11-30 | Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quaranti… |
CVE-2022-39258 | High | 8.1 | 2022-09-27 | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links… |
CVE-2024-41959 | High | 7.6 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. Thi… |
CVE-2023-26490 | High | 7.3 | 2023-03-04 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard u… |
CVE-2025-25198 | High | 7.1 | 2025-02-12 | mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionali… |
CVE-2024-41958 | Medium | 6.6 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechani… |
CVE-2024-30270 | Medium | 6.2 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-31204 | Medium | 6.1 | 2024-04-04 | mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior t… |
CVE-2024-23824 | Medium | 4.7 | 2024-02-02 | mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the pa… |
CVE-2024-41960 | Low | 3.8 | 2024-08-05 | mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload into the Relay Hosts c… |