CVE-2026-125757

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered b...

CVE-2026-125757 mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered b...

EUVD-2026-121240

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered b...

CVE-2026-125757

The mailcow: dockerized email server (versions before 2026-11 ) is vulnerable to a Server-Side Template Injection (SSTI) . The flaw exists because the rspamd MOO_FOOTER prefilter fails to properly neutralize inputs, allowing a user with domain administrator privileges to execute commands in the s...

CVE-2026-125757: mailcow mailcow: dockerized: mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain…

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered b...