CVE-2026-125757 · Package
NO FIX YET · SEE WHAT TO DO
mailcow dockerized before 2026-11 lets a domain administrator store a malicious domain-wide footer that is rendered as a Jinja template by the rspamd filter. The attacker can run commands in the shared rspamd container, read or inject mail for every tenant, and disable spam filtering.
first public Nov 10, 2026 · 1 public exploit · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Hosts running mailcow dockerized before 2026-11 with multiple tenant domains, where domain administrators are not fully trusted. The flaw sits in the shared rspamd container, so one tenant's footer can reach every tenant's mail. Single-tenant installs with only trusted administrators carry less risk.
Not affected if mailcow-at-or-above-2026-11, single-tenant
Who cares mailcow, email, rspamd, self-hosted
2026-112026-11 or later (per the sources' 'before 2026-11' range)mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.