CVE-2025-25198: mailcow: dockerized vulnerable to password reset poisoning

Published Feb 12, 2025

Updated

mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the Host HTTP header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing Notification email sender and Notification email subject under System -> Configuration -> Options -> Password Settings.

Affected Software

2 affected components

Mailcow mailcow: dockerized<2025-01a

Mailcow Mailcow\<2025-01a

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mailcow: dockerized to a version that resolves this vulnerability.
Fixed in 2025-01a
Configuration
As a workaround, deactivate the password reset functionality by clearing 'Notification email sender' under System -> Configuration -> Options -> Password Settings.
mailcow: dockerized (System -> Configuration -> Options -> Password Settings) Notification email sender
Configuration
As a workaround, deactivate the password reset functionality by clearing 'Notification email subject' under System -> Configuration -> Options -> Password Settings.
mailcow: dockerized (System -> Configuration -> Options -> Password Settings) Notification email subject

Event History

Feb 12, 2025

CVE Published

via MITRE·05:46 PM

Data Sourced

via MITRE·05:46 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Oct 14, 2025

Exploit Published

via GitHub·03:14 AM

Frequently Asked Questions

What is the severity of CVE-2025-25198?

CVE-2025-25198 has a high severity rating due to its potential to allow unauthorized password reset link creation.

How do I fix CVE-2025-25198?

To mitigate CVE-2025-25198, upgrade mailcow: dockerized to version 2025-01a or later.

What attack does CVE-2025-25198 enable?

CVE-2025-25198 enables attackers to manipulate the Host HTTP header for creating malicious password reset links.

Which versions are affected by CVE-2025-25198?

All versions of mailcow: dockerized prior to 2025-01a are affected by CVE-2025-25198.

Is there a workaround for CVE-2025-25198?

There is no officially documented workaround for CVE-2025-25198, and upgrading is the recommended action.