CVE-2026-40878: mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw $SERVER['REQUESTURI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of the context-appropriate js escaping strategy. In addition, the querystring() Twig helper merges all current $GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow-dockerizedto a version that resolves this vulnerability.Fixed in 2026-03b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40878?
CVE-2026-40878 is classified as a high severity vulnerability due to its potential for reflected parameter injection and cross-site scripting.
How do I fix CVE-2026-40878?
To fix CVE-2026-40878, upgrade your mailcow-dockerized instance to version 2026-03b or later.
What impact does CVE-2026-40878 have on mailcow-dockerized?
CVE-2026-40878 allows attackers to inject malicious scripts into the login page, which can compromise user accounts.
Which versions of mailcow-dockerized are affected by CVE-2026-40878?
Versions of mailcow-dockerized prior to 2026-03b are affected by CVE-2026-40878.
Is CVE-2026-40878 easy to exploit?
CVE-2026-40878 is considered to be relatively easy to exploit due to its reliance on reflected parameters.