GHSA-jgr3-fv33-x43c: mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOOFOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow: dockerizedto a version that resolves this vulnerability.Fixed in 2026-11
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs domain-administrator privileges and the ability to store a domain-wide footer. No user interaction is required once the malicious footer is rendered by the rspamd MOO_FOOTER prefilter.
What systems and tenants are at risk after exploitation?
The attacker can execute commands in the shared rspamd container. This can allow reading or injecting mail for every tenant and disabling filtering, so the impact is not limited to the attacker’s own domain.
Which deployments are affected?
Mailcow dockerized versions before 2026-11 are affected according to the available information.