mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager. The Queue Manager fetches mail queue entries from /api/v1/get/mailq/all, copies server-controlled Postfix queue fields into DataTables rows, and renders several of those fields as HTML without adequate output encoding.
This issue affects mailcow-dockerized: 2026-03b.
mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw $SERVER['REQUESTURI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of the context-appropriate js escaping strategy. In addition, the querystring() Twig helper merges all current $GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.
Just had CVE-2026-40871 assigned and the advisory published for mailcow-dockerized.
Summary:
It's a second-order SQL injection in the quarantine\category field when creating mailboxes via the Mailcow API (/api/v1/add/mailbox).
The value is stored unsanitized in the database.
Later, when quarantine\notify.py runs (during quarantine notification jobs), it builds SQL queries using unsafe Python string formatting (% operator) instead of parameterized queries.
This allows an attacker with API access to inject arbitrary SQL, which can lead to sensitive data exfiltration (e.g. admin credentials) through the notification emails themselves.
Full write up and Advisory
GitHub Advisory: https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q Full write-up: https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2026-40871.md