mailcow

Records23All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

mailcow records in CISA KEV

No mailcow vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mailcow 16 records HIGH

Records

23 records

TI-2026-29528 CVE-2026-40872

mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field

HIGH 81

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00361 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2026-29529 CVE-2026-40873

mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames

HIGH 74

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0HIGH 8.9 Network No auth User interaction EPSS 0.0042 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2022-13182 CVE-2022-31138

OS Command Injection in mailcow

HIGH 73

mailcow is a mailserver suite.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0328 Published 2022-07-11 Fixed in 2022-06a CWE-78

TI-2022-18634 CVE-2022-39258

mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

HIGH 71

mailcow is a mailserver suite.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.01832 Published 2022-09-27 Fixed in 2022-09 CWE-200

TI-2026-06557 CVE-2026-7460 · GHSA-4wpv-p8hj-wr36

mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped

HIGH 68

mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager.

CVSS 4.0HIGH 7.4 Network Low privileges User interaction EPSS 0.0032 Published 2026-05-20 No fix listed CWE-79

TI-2026-29527 CVE-2026-40871

mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API

HIGH 67

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.08565 Published 2026-04-21 Fixed in 2026-03b CWE-116

TI-2026-29531 CVE-2026-40875

mailcow: dockerized vulnerable to stored XSS in user login history real_rip

MEDIUM 64

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0HIGH 7.0 Network Low privileges User interaction EPSS 0.00238 Published 2026-04-21 Fixed in 2026-03b CWE-79

TI-2026-29530 CVE-2026-40874

mailcow: dockerized missing authorization on Forwarding Hosts delete action

MEDIUM 60

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.0017 Published 2026-04-21 Fixed in 2026-03b CWE-284

TI-2024-15818 CVE-2024-23824

mailcow ipixel flood attack leads to Denial of Service in admin page

MEDIUM 55

mailcow is a dockerized email package, with multiple containers linked in one bridged network.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00597 Published 2024-02-02 Fixed in 2024-01 CWE-400

TI-2024-20015 CVE-2024-30270

mailcow Path Traversal and Arbitrary Code Execution Vulnerability

MEDIUM 50

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.27346 Published 2024-04-04 Fixed in 2024-04 CWE-22

TI-2023-11637 CVE-2023-26490

mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync

MEDIUM 48

mailcow is a dockerized email package, with multiple containers linked in one bridged network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0222 Published 2023-03-03 Fixed in 2023-03 CWE-78

TI-2022-13278 CVE-2022-31245 · GHSA-724h-f4rh-cc47

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and…

MEDIUM 47

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05566 Published 2022-05-20 No fix listed CWE-78

TI-2024-16277 CVE-2024-24760

Mailcow Docker Container Exposure to Local Network

MEDIUM 42

mailcow is a dockerized email package, with multiple containers linked in one bridged network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00868 Published 2024-02-02 Fixed in 2024-01c CWE-610

TI-2023-16954 CVE-2023-34108

Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

MEDIUM 42

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00979 Published 2023-06-07 Fixed in 2023-05a CWE-78

TI-2017-06420 CVE-2017-8928 · GHSA-5jvq-xmw7-69rm

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

MEDIUM 42

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02049 Published 2017-05-14 No fix listed CWE-352

TI-2025-33781 CVE-2025-53909

mailcow: dockerized vulnerable to SSTI in Quota and Quarantine Notification Template

MEDIUM 40

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00537 Published 2025-07-17 Fixed in 2025-07 CWE-1336

TI-2025-18867 CVE-2025-25198

mailcow: dockerized vulnerable to password reset poisoning

MEDIUM 40

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01121 Published 2025-02-12 Fixed in 2025-01a CWE-601

TI-2024-20581 CVE-2024-31204

mailcow Cross-site Scripting Vulnerability via Exception Handler

MEDIUM 40

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1MEDIUM 6.1 Adjacent network Low privileges User interaction EPSS 0.08249 Published 2024-04-04 Fixed in 2024-04 CWE-79

TI-2023-26742 CVE-2023-49077

mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

LOW 36

Mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00443 Published 2023-11-30 Fixed in 2023-11 CWE-79

TI-2024-27980 CVE-2024-41958

Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

LOW 34

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01035 Published 2024-08-05 Fixed in 2024-07 CWE-697

TI-2024-27981 CVE-2024-41959

Cross-site Scripting (XSS) via API Logs in mailcow: dockerized

LOW 33

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00352 Published 2024-08-05 Fixed in 2024-07 CWE-79

TI-2024-27982 CVE-2024-41960

Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized

LOW 22

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2024-08-05 Fixed in 2024-07 CWE-79

TI-2026-29534 CVE-2026-40878

mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping

LOW 13

mailcow: dockerized is an open source groupware/email suite based on docker.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00805 Published 2026-04-21 Fixed in 2026-03b CWE-79

Open these records in search →