Server-Side Template Injection Vulnerability in Mailcow by Mailcow
CVE-2025-53909

9.1CRITICAL

Key Information:

Vendor

Mailcow

Status
Mailcow-dockerized
Vendor
CVE Published:
17 July 2025

What is CVE-2025-53909?

Mailcow: Dockerized, an open-source groupware and email suite, is affected by a Server-Side Template Injection vulnerability found in the notification template system used for sending quota and quarantine alerts. This issue allows for template expressions that may be exploited to execute arbitrary code, necessitating admin-level access to configure templates in the Mailcow UI. The templates are processed automatically during routine system operations, increasing the threat level significantly. Users are strongly advised to upgrade to version 2025-07, which addresses this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

mailcow-dockerized < 2025-07

References

https://github.com/mailcow/mailcow-dockerized/security/ad...
x_refsource_CONFIRM
https://github.com/mailcow/mailcow-dockerized/commit/8c5f...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.