CVE-2025-53909: mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template
mailcow: dockerized is an open source groupware/email suite based on docker. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 2025-07 in the notification template system used by mailcow for sending quota and quarantine alerts. The template rendering engine allows template expressions that may be abused to execute code in certain contexts. The issue requires admin-level access to mailcow UI to configure templates, which are automatically rendered during normal system operation. Version 2025-07 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53909?
CVE-2025-53909 is classified as a medium severity vulnerability due to the potential for Server-Side Template Injection affecting mailcow: dockerized.
How do I fix CVE-2025-53909?
To fix CVE-2025-53909, upgrade mailcow: dockerized to version 2025-07 or later.
What does CVE-2025-53909 affect?
CVE-2025-53909 affects all versions of mailcow: dockerized prior to 2025-07.
What type of vulnerability is CVE-2025-53909?
CVE-2025-53909 is a Server-Side Template Injection (SSTI) vulnerability found in the notification template system.
What are the consequences of exploiting CVE-2025-53909?
Exploitation of CVE-2025-53909 can lead to unauthorized access and execution of arbitrary code on the server.