CVE-2026-125757: mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

Published Nov 10, 2026

Updated

mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOOFOOTER prefilter, to read or inject mail for every tenant and disable filtering.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mailcow: dockerized to a version that resolves this vulnerability.
Fixed in 2026-11

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs domain administrator privileges in mailcow. They can store a malicious domain-wide footer that is later rendered by the rspamd MOO_FOOTER prefilter.

What is the potential impact beyond the attacker’s own domain?

Successful exploitation allows command execution in the shared rspamd container. This can allow the attacker to read or inject mail for every tenant and disable filtering.

Which deployments are affected?

mailcow: dockerized versions before the 2026-11 release are affected. The provided fix is associated with the 2026-11 release and commit e986803980db8b29435a2ddba5d9760737a818e3.

CVE-2026-125757: mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact beyond the attacker’s own domain?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact beyond the attacker’s own domain?

Which deployments are affected?