CVE-2026-40878

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw "$SERVER'REQUESTURI'" to Twig as a global template variable and renders it inside a JavaScript string literal in the "setLang" helper of "base.twig"...