Server-Side Template Injection in Mailcow: Dockerized Affecting Multiple Instances

CVE-2026-125757

What is CVE-2026-125757?

The vulnerability in Mailcow: Dockerized allows domain administrators to leverage a server-side template injection, potentially compromising the system's security. By storing a malicious domain-wide footer, attackers can execute arbitrary commands within the shared rspamd container. This is achieved by embedding a Jinja macro with the os.execute function, which the rspamd MOO_FOOTER prefilter processes. As a result, attackers could read or manipulate emails across all tenants, significantly undermining mail filtering functionalities. Organizations must take proactive measures to update to Mailcow: Dockerized version 2026-11 or later to safeguard their systems.

References