CVE-2026-40873: mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow: dockerizedto a version that resolves this vulnerability.Fixed in 2026-03b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40873?
CVE-2026-40873 is classified as a medium severity stored XSS vulnerability.
How do I fix CVE-2026-40873?
To fix CVE-2026-40873, update to mailcow: dockerized version 2026-03b or later.
What impact does CVE-2026-40873 have on users?
CVE-2026-40873 allows malicious attachment filenames to execute arbitrary JavaScript in the context of the user's session.
Which versions of mailcow: dockerized are affected by CVE-2026-40873?
Versions of mailcow: dockerized prior to 2026-03b are affected by CVE-2026-40873.
Is CVE-2026-40873 easily exploitable?
Yes, CVE-2026-40873 can be exploited by tricking users into opening emails with malicious attachment filenames.