HTML Injection Vulnerability in mailcow: Dockerized Groupware Suite
CVE-2026-40878

2.1LOW

Key Information:

Vendor

Mailcow

Status
Mailcow-dockerized
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40878?

An HTML injection vulnerability exists in mailcow: dockerized due to improper handling of $_SERVER['REQUEST_URI'] within the web interface. This flaw allows an attacker to inject malicious scripts through the language-switching links on the login page. The affected versions fail to implement proper context-sensitive escaping, enabling the execution of arbitrary scripts. Mailcow has addressed this issue in version 2026-03b, enhancing the security of its groupware suite.

Affected Version(s)

mailcow-dockerized < 2026-03b

References

https://github.com/mailcow/mailcow-dockerized/security/ad...
x_refsource_CONFIRM

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.